{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-998b1226f580efff", "name": "Possibly dead Python function: handle_startendtag", "shortDescription": {"text": "Possibly dead Python function: handle_startendtag"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1e647768aa3bfd8", "name": "Possibly dead Python function: handle_data", "shortDescription": {"text": "Possibly dead Python function: handle_data"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc271bb50e9c5f9a", "name": "Possibly dead Python function: redirect_request", "shortDescription": {"text": "Possibly dead Python function: redirect_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c885058381ad4fe8", "name": "Possibly dead Python function: stream", "shortDescription": {"text": "Possibly dead Python function: stream"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c344f23eeb0465", "name": "Possibly dead Python function: execute_code", "shortDescription": {"text": "Possibly dead Python function: execute_code"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fae551a07c0593c5", "name": "dynamic urllib use detected \u2014 scripts/openwebui/seed_openwebui.py:117", "shortDescription": {"text": "dynamic urllib use detected \u2014 scripts/openwebui/seed_openwebui.py:117"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-9c70e844bf012cd0", "name": "dynamic urllib use detected \u2014 scripts/openwebui/tool_weather.py:13", "shortDescription": {"text": "dynamic urllib use detected \u2014 scripts/openwebui/tool_weather.py:13"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-7b1bd875f5a756b3", "name": "CVE-2026-34993: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-34993: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.0\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19c6593f77847057", "name": "CVE-2026-47265: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-47265: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.0\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38e2a20eca2f2493", "name": "CVE-2026-54273: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54273: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Denial of Service via excessive pipelined requests\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58146b01331e8e00", "name": "CVE-2026-54274: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54274: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: aiohttp: Denial of Service via incomplete websocket frame payloads\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d92e64c021d9402", "name": "CVE-2026-54276: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54276: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: aiohttp: Information disclosure via DigestAuthMiddleware after cross-origin redirect\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7f3bfdc15e643c2", "name": "CVE-2026-54277: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54277: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: aiohttp: Denial of Service via oversized HTTP request lines bypassing max_line_size check\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d82cda415ed63e4f", "name": "CVE-2026-54278: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54278: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: aiohttp: Denial of Service due to excessive memory consumption from compressed request body\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e9846a76c6bf7076", "name": "CVE-2026-50269: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-50269: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: AIOHTTP: CRLF injection in multipart headers\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerabi\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.0\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-866b1585aa5f6f03", "name": "CVE-2026-54275: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54275: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: AIOHTTP: TLS SNI check bypass via connection reuse\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e147b462d40fd8b", "name": "CVE-2026-54279: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54279: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Host-Only Cookies Become Domain Cookies After CookieJar Persistence\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80ceef5f98b6e284", "name": "CVE-2026-54280: aiohttp 3.13.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54280: aiohttp 3.13.5 \u2014 uv.lock"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.5\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b261b937a63691c0", "name": "CVE-2026-34450: anthropic 0.86.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-34450: anthropic 0.86.0 \u2014 uv.lock"}, "fullDescription": {"text": "Claude SDK for Python has Insecure Default File Permissions in Local Filesystem Memory Tool\n\nThe Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a standard umask and world-writable in environments with a permissive umask such as many Docker base images. A local attacker on a shared host could read persisted agent state, and in containerized deployments could modify me\n\nPackage: anthropic\nInstalled: 0.86.0\nFixed in: 0.87.0\nSeverity: MEDIUM\nFix: Upgrade anthropic to 0.87.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb188ad4bf2cafac", "name": "CVE-2026-34452: anthropic 0.86.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-34452: anthropic 0.86.0 \u2014 uv.lock"}, "fullDescription": {"text": "Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape\n\nThe Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a symlink between validation and use, causing reads or writes to escape the s\n\nPackage: anthropic\nInstalled: 0.86.0\nFixed in: 0.87.0\nSeverity: MEDIUM\nFix: Upgrade anthropic to 0.87.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5def7cf2e2586c15", "name": "CVE-2026-45829: chromadb 1.5.9 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-45829: chromadb 1.5.9 \u2014 uv.lock"}, "fullDescription": {"text": "chromadb: ChromaDB Python Project: Arbitrary code execution via pre-authentication code injection\n\nA pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the\u00a0/api/v2/tenants/{tenant}/databases/{db}/collections endpoint.\n\nPackage: chromadb\nInstalled: 1.5.9\nFixed in: \u2014\nSeverity: CRITICAL\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-1573ce9e96f794df", "name": "GHSA-537c-gmf6-5ccf: cryptography 48.0.0 \u2014 uv.lock", "shortDescription": {"text": "GHSA-537c-gmf6-5ccf: cryptography 48.0.0 \u2014 uv.lock"}, "fullDescription": {"text": "Vulnerable OpenSSL included in cryptography wheels\n\npyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20260609.txt.\n\nIf you are building cryptography source (\"sdist\") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on \n\nPackage: cryptography\nInstalled: 48.0.0\nFixed in: 48.0.1\nSeverity: HIGH\nFix: Upgrade cryptography to 48.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2471f23cea2faf3b", "name": "CVE-2024-23342: ecdsa 0.19.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2024-23342: ecdsa 0.19.1 \u2014 uv.lock"}, "fullDescription": {"text": "python-ecdsa: vulnerable to the Minerva attack\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.\n\nPackage: ecdsa\nInstalled: 0.19.1\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4d7700c60601a813", "name": "CVE-2026-33936: ecdsa 0.19.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-33936: ecdsa 0.19.1 \u2014 uv.lock"}, "fullDescription": {"text": "python-ecdsa: ecdsa: Denial of Service via crafted DER input\n\nThe `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Prior to version 0.19.2, an issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. `ecdsa.der.remove_octet_string()` accepts truncated DER where the encoded length exceeds the ava\n\nPackage: ecdsa\nInstalled: 0.19.1\nFixed in: 0.19.2\nSeverity: MEDIUM\nFix: Upgrade ecdsa to 0.19.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-206a6aeb11dedddf", "name": "CVE-2026-45409: idna 3.11 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-45409: idna 3.11 \u2014 uv.lock"}, "fullDescription": {"text": "python-idna: idna: Denial of Service via specially crafted long inputs\n\nInternationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi\n\nPackage: idna\nInstalled: 3.11\nFixed in: 3.15\nSeverity: MEDIUM\nFix: Upgrade idna to 3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8a09cee990a383c", "name": "CVE-2026-55443: langchain 1.2.10 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-55443: langchain 1.2.10 \u2014 uv.lock"}, "fullDescription": {"text": "LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders\n\nLangChain is a framework for building agents and LLM-powered applications. Prior to 1.3.9, several LangChain components that resolve filesystem paths or expand search patterns do not consistently confine the resolved path to the intended root directory. Affected behaviors include: a file-search agent middleware that validates a starting directory but not the search pattern or the resolved target of matched files, so glob patterns and symlinks can reach files outside the configured root; prompt- \n\nPackage: langchain\nInstalled: 1.2.10\nFixed in: 1.3.9\nSeverity: MEDIUM\nFix: Upgrade langchain to 1.3.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-674f962168d09333", "name": "CVE-2026-48775: langgraph-checkpoint 4.0.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48775: langgraph-checkpoint 4.0.1 \u2014 uv.lock"}, "fullDescription": {"text": "langgraph: langgraph-checkpoint: LangGraph: Arbitrary code execution via insecure deserialization of modified checkpoint bytes\n\nLangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time. T\n\nPackage: langgraph-checkpoint\nInstalled: 4.0.1\nFixed in: 4.1.1\nSeverity: MEDIUM\nFix: Upgrade langgraph-checkpoint to 4.1.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4efa954f96da41bc", "name": "CVE-2026-48776: langgraph-sdk 0.3.12 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48776: langgraph-sdk 0.3.12 \u2014 uv.lock"}, "fullDescription": {"text": "langgraph: langgraph-sdk: LangGraph Python SDK: Unsafe URL path construction leads to unauthorized resource access\n\nLangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values used in HTTP request paths for resource operations. Without sanitization of those values, identifiers that contain characters with special meaning in URL paths could cause the resulting request to address a different resource (and potentially \n\nPackage: langgraph-sdk\nInstalled: 0.3.12\nFixed in: 0.3.15\nSeverity: MEDIUM\nFix: Upgrade langgraph-sdk to 0.3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4ffb4c314812f696", "name": "CVE-2026-45134: langsmith 0.7.22 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-45134: langsmith 0.7.22 \u2014 uv.lock"}, "fullDescription": {"text": "LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to LangSmith SDK Python 0.8.0 and JS/TS 0.6.0, the LangSmith SDK's prompt pull methods (pull_prompt / pull_prompt_commit in Python, pullPrompt / pullPromptCommit in JS/TS) fetch and deserialize prompt manifests from the LangSmith Hub. These manifests may contain serialized LangChain objects and model configuration that affect runtime behavior. When pulling a public prompt by owner/name identifier, the manifest\n\nPackage: langsmith\nInstalled: 0.7.22\nFixed in: 0.8.0\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b1ad8a41f6f201a", "name": "GHSA-f4xh-w4cj-qxq8: langsmith 0.7.22 \u2014 uv.lock", "shortDescription": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.7.22 \u2014 uv.lock"}, "fullDescription": {"text": "LangSmith SDK TracingMiddleware: Arbitrary server-side file read\n\n# Summary\n\nAn attacker who can send an HTTP request to a server running the LangSmith SDK's `TracingMiddleware` can cause that server to read an arbitrary file from its local filesystem and upload the contents to LangSmith as a trace attachment. Depending on how the distributed trace system is deployed, triggering a read may not require authentication. Retrieving the contents requires read access to the LangSmith workspace the traces are sent to. The net effect is a trust-boundary crossing: a pa\n\nPackage: langsmith\nInstalled: 0.7.22\nFixed in: 0.8.18\nSeverity: HIGH\nFix: Upgrade langsmith to 0.8.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0c72ee6859586413", "name": "CVE-2026-41182: langsmith 0.7.22 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-41182: langsmith 0.7.22 \u2014 uv.lock"}, "fullDescription": {"text": "LangSmith SDK: Streaming token events bypass output redaction\n\nLangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redaction controls (hideOutputs in JS, hide_outputs in Python) do not apply to streaming token events. When an LLM run produces streaming output, each chunk is recorded as a new_token event containing the raw token value. These events bypass the redaction pipeline entirely \u2014 prepareRunCreateOrUpdateInputs (\n\nPackage: langsmith\nInstalled: 0.7.22\nFixed in: 0.7.31\nSeverity: MEDIUM\nFix: Upgrade langsmith to 0.7.31"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cc76acfbf412673", "name": "CVE-2026-41066: lxml 6.0.2 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-41066: lxml 6.0.2 \u2014 uv.lock"}, "fullDescription": {"text": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read\n\nlxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.\n\nPackage: lxml\nInstalled: 6.0.2\nFixed in: 6.1.0\nSeverity: HIGH\nFix: Upgrade lxml to 6.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0589c026896ab41d", "name": "CVE-2026-41205: mako 1.3.10 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-41205: mako 1.3.10 \u2014 uv.lock"}, "fullDescription": {"text": "mako: Mako: Information disclosure via path traversal vulnerability\n\nMako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is an inconsistency between two slash-stripping implementations. Any file readable by the process can be returned as rendered template content when an application passes untrusted input directly to TemplateLookup.get_template(). This vulnerability is fixed in 1.3.11.\n\nPackage: mako\nInstalled: 1.3.10\nFixed in: 1.3.11\nSeverity: HIGH\nFix: Upgrade mako to 1.3.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a9ad76807ad5bd77", "name": "CVE-2026-44307: mako 1.3.10 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-44307: mako 1.3.10 \u2014 uv.lock"}, "fullDescription": {"text": "mako: Mako: Information disclosure via directory traversal\n\nMako is a template library written in Python. Prior to 1.3.12, on Windows, a URI using backslash traversal (e.g. \\..\\..\\ secret.txt) bypasses the directory traversal check in Template.__init__ and the posixpath-based normalization in TemplateLookup.get_template(), allowing reads of files outside the configured template directory. This vulnerability is fixed in 1.3.12.\n\nPackage: mako\nInstalled: 1.3.10\nFixed in: 1.3.12\nSeverity: HIGH\nFix: Upgrade mako to 1.3.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3bee0e51d6b49ef1", "name": "CVE-2026-59950: mcp 1.27.2 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59950: mcp 1.27.2 \u2014 uv.lock"}, "fullDescription": {"text": "MCP Python SDK: WebSocket server transport does not support Host/Origin validation\n\nThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restrict which origins could connect to applications that exposed that transport. This issue is fixed in version 1.28.1.\n\nPackage: mcp\nInstalled: 1.27.2\nFixed in: 1.28.1\nSeverity: HIGH\nFix: Upgrade mcp to 1.28.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0b2ce8cfd087191f", "name": "CVE-2026-54293: nltk 3.9.4 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54293: nltk 3.9.4 \u2014 uv.lock"}, "fullDescription": {"text": "nltk: NLTK: Information Disclosure via Path Traversal in `nltk.data.load()`\n\nNLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.load() in NLTK is vulnerable to path traversal via URL-encoded path separators and traversal segments when using the nltk: URL scheme. The unsafe-path regex check is performed before url2pathname() decodes the %xx sequences (a classic decode-after-check / TOCTOU-style flaw), allowing an attacker to by\n\nPackage: nltk\nInstalled: 3.9.4\nFixed in: 3.10.0\nSeverity: HIGH\nFix: Upgrade nltk to 3.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9737b39b2a7551a7", "name": "CVE-2026-54058: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54058: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image\n\nPillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as Image.tobytes(), getpixel, convert, or save to read beyond the mapped region and disclose adjacent process memory or fault. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-92f5952034493030", "name": "CVE-2026-54059: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54059: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted PCF font data\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1ff9f66ba430e736", "name": "CVE-2026-54060: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54060: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new(\"1\", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c85e0cc00b91ed7", "name": "CVE-2026-55379: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-55379: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted BDF font file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0b2568d3cbcb767f", "name": "CVE-2026-55380: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-55380: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Denial of Service via crafted GD 2.x image file\n\nPillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8f83941fee577645", "name": "CVE-2026-59197: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59197: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Native heap out-of-bounds write\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size validation and ImagingExpand() computes output dimensions with unchecked signed int arithmetic. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e268c1133819fbf", "name": "CVE-2026-59199: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59199: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via out-of-bounds write in image processing\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow public image coordinate APIs can trigger a native heap out-of-bounds write when given coordinates near the signed 32-bit integer limits in Image.paste(), Image.crop(), or Image.alpha_composite(). This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8297d3abcb7190eb", "name": "CVE-2026-59200: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59200: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of service via crafted PDF stream\n\nPillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to exhaust memory from a small file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f4c42d809f3d4d4", "name": "CVE-2026-59204: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59204: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted JPEG2000 image\n\nPillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and trigger out-of-memory failures during decoding. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4254579d8b441828", "name": "CVE-2026-59205: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59205: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API\n\nPillow is a Python imaging library. Prior to 12.3.0, Pillow's ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eee5d94fc3e70870", "name": "CVE-2026-55798: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-55798: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "python-pillow: Pillow: Arbitrary command injection via shell metacharacters in file paths\n\nPillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-027941125df659f6", "name": "CVE-2026-59198: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59198: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Information disclosure via TGA RLE encoder out-of-bounds read\n\nPillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bff8feb430b5016c", "name": "CVE-2026-59203: pillow 12.2.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59203: pillow 12.2.0 \u2014 uv.lock"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via crafted EPS file\n\nPillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0.\n\nPackage: pillow\nInstalled: 12.2.0\nFixed in: 12.3.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90d30c42276a0d32", "name": "CVE-2026-25087: pyarrow 20.0.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-25087: pyarrow 20.0.0 \u2014 uv.lock"}, "fullDescription": {"text": "apache-arrow: Apache Arrow C++: Denial of Service via Use After Free vulnerability when reading IPC files\n\nUse After Free vulnerability in Apache Arrow C++.\n\nThis issue affects Apache Arrow C++ from 15.0.0 through 23.0.0. It can be triggered when reading an Arrow IPC file (but not an IPC stream) with pre-buffering enabled, if the IPC file contains data with variadic buffers (such as Binary View and String View data). Depending on the number of variadic buffers in a record batch column and on the temporal sequence of multi-threaded IO, a write to a dangling pointer could occur. The value (a `std::shar\n\nPackage: pyarrow\nInstalled: 20.0.0\nFixed in: 23.0.1\nSeverity: HIGH\nFix: Upgrade pyarrow to 23.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0bf4b6732214b3f2", "name": "CVE-2026-59885: pyasn1 0.6.3 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59885: pyasn1 0.6.3 \u2014 uv.lock"}, "fullDescription": {"text": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values.\n\nPackage: pyasn1\nInstalled: 0.6.3\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-988094facb9cf24b", "name": "CVE-2026-59886: pyasn1 0.6.3 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59886: pyasn1 0.6.3 \u2014 uv.lock"}, "fullDescription": {"text": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values\n\npyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float conversion through prettyPrint(), str(), comparison, arithmetic, int(), or an explicit float() call to consume excessive CPU and memory and hang applications that decode untrusted ASN.1 data and then print\n\nPackage: pyasn1\nInstalled: 0.6.3\nFixed in: 0.6.4\nSeverity: HIGH\nFix: Upgrade pyasn1 to 0.6.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c9f940291de2b45", "name": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.13.1 \u2014 uv.lock", "shortDescription": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.13.1 \u2014 uv.lock"}, "fullDescription": {"text": "pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size\n\n### Summary\n\n`NestedSecretsSettingsSource` reads secret values from files in a configured `secrets_dir`. When `secrets_nested_subdir=True`, a directory entry inside `secrets_dir` that is a symbolic link pointing **outside** `secrets_dir` is followed, so files outside the configured directory are read into settings values. The same code path bypasses the documented `secrets_dir_max_size` protection. An attacker or lower-privileged component able to influence entries in the configured secrets dire\n\nPackage: pydantic-settings\nInstalled: 2.13.1\nFixed in: 2.14.2\nSeverity: MEDIUM\nFix: Upgrade pydantic-settings to 2.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0da8a15114591082", "name": "CVE-2026-4539: pygments 2.19.2 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-4539: pygments 2.19.2 \u2014 uv.lock"}, "fullDescription": {"text": "pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer\n\nA security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nPackage: pygments\nInstalled: 2.19.2\nFixed in: 2.20.0\nSeverity: LOW\nFix: Upgrade pygments to 2.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f94af0b7a786f230", "name": "CVE-2026-31826: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-31826: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.8.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing a content stream with a rather large /Length value, regardless of the actual data length inside the stream. This vulnerability is fixed in 6.8.0.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.8.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.8.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0484fcf12807a249", "name": "CVE-2026-33123: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-33123: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.9.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.9.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8005a9a0478b520c", "name": "CVE-2026-33699: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-33699: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode\n\npypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.2 have a vulnerability in which an attacker can craft a PDF which leads to an infinite loop. This requires reading a file in non-strict mode. This has been fixed in pypdf 6.9.2. If users cannot upgrade yet, consider applying the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.9.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.9.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-765cbeb01cbb8fa5", "name": "CVE-2026-40260: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-40260: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to memory exhaustion via manipulated XMP metadata\n\npypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the XMP metadata. This issue has been fixed in version 6.10.0.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.10.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad68b84f796b5064", "name": "CVE-2026-41168: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-41168: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with oversized streams\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-reference streams with wrong large `/Size` values or object streams with wrong large `/N` values. This has been fixed in pypdf 6.10.1. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.10.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7205aff6de40498f", "name": "CVE-2026-41312: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-41312: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service due to excessive memory consumption via specially crafted PDF\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing a stream compressed using `/FlateDecode` with a `/Predictor` unequal 1 and large predictor parameters. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a92b10fe35288858", "name": "CVE-2026-41313: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-41313: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large trailer /Size value\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a PDF with a large trailer `/Size` value in incremental mode. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2de054d46dd97fb", "name": "CVE-2026-41314: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-41314: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large image sizes\n\npypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires accessing an image using `/FlateDecode` with large size values. This has been fixed in pypdf 6.10.2. As a workaround, one may apply the changes from the patch manually.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.10.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.10.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1d8ba13a957c7e67", "name": "CVE-2026-48155: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48155: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large character offsets\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets. This vulnerability is fixed in 6.12.0.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.12.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-062e893e387131c2", "name": "CVE-2026-48156: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48156: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values. This vulnerability is fixed in 6.12.0.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.12.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34102fca5df6b14b", "name": "CVE-2026-48735: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48735: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with large XMP metadata\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.1, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing large XMP metadata, possibly with lots of unnecessary elements. This vulnerability is fixed in 6.12.1.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.12.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf605bb88103bf25", "name": "CVE-2026-49460: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-49460: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with FlateDecode filter\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /FlateDecode filter with a PNG predictor. This vulnerability is fixed in 6.12.2.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.12.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c0eb2de74a7410a7", "name": "CVE-2026-49461: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-49461: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with self-referencing form XObject\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.12.2, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting the text of a page which contains a form XObject with self-references. This vulnerability is fixed in 6.12.2.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.12.2\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.12.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1912a02fa197423", "name": "CVE-2026-54530: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54530: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF processing\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires extracting the text in layout mode. This vulnerability is fixed in 6.13.0.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.13.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d83a50184be8ffb", "name": "CVE-2026-54531: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54531: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: pypdf: Denial of Service via crafted PDF with outlines\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.0, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with outlines into a writer. This vulnerability is fixed in 6.13.0.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.13.0\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b14f220c2e57a48", "name": "CVE-2026-54651: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54651: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: python-pypdf: pypdf: Denial of Service via crafted PDF\n\npypdf is a free and open-source pure-python PDF library. Prior to 6.13.1, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires merging a file with threads/articles into a writer. This vulnerability is fixed in 6.13.1.\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.13.1\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1af24325312cd7f8", "name": "GHSA-jm82-fx9c-mx94: pypdf 6.7.5 \u2014 uv.lock", "shortDescription": {"text": "GHSA-jm82-fx9c-mx94: pypdf 6.7.5 \u2014 uv.lock"}, "fullDescription": {"text": "pypdf: Missing stream length values ignore defined limits\n\n### Impact\n\nAn attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as `MAX_DECLARED_STREAM_LENGTH` is sometimes ignored. This requires parsing a content stream without a `/Length` value.\n\n### Patches\nThis has been fixed in [pypdf==6.13.3](https://github.com/py-pdf/pypdf/releases/tag/6.13.3).\n\n### Workarounds\nIf you cannot upgrade yet, consider applying the changes from PR [#3871](https://github.com/py-pdf/pypdf/pull/3871).\n\nPackage: pypdf\nInstalled: 6.7.5\nFixed in: 6.13.3\nSeverity: MEDIUM\nFix: Upgrade pypdf to 6.13.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0424664fd0e0e4ab", "name": "CVE-2026-53539: python-multipart 0.0.27 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-53539: python-multipart 0.0.27 \u2014 uv.lock"}, "fullDescription": {"text": "python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the ne\n\nPackage: python-multipart\nInstalled: 0.0.27\nFixed in: 0.0.30\nSeverity: HIGH\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4376ea905d85267f", "name": "CVE-2026-53537: python-multipart 0.0.27 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-53537: python-multipart 0.0.27 \u2014 uv.lock"}, "fullDescription": {"text": "multipart: Python-Multipart: Information disclosure via header parsing discrepancy\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 \u00a74.2 explicitly forbid\n\nPackage: python-multipart\nInstalled: 0.0.27\nFixed in: 0.0.30\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c50601e749d9bf4", "name": "CVE-2026-53538: python-multipart 0.0.27 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-53538: python-multipart 0.0.27 \u2014 uv.lock"}, "fullDescription": {"text": "python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form \n\nPackage: python-multipart\nInstalled: 0.0.27\nFixed in: 0.0.30\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b650d0feb8010a93", "name": "CVE-2026-53540: python-multipart 0.0.27 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-53540: python-multipart 0.0.27 \u2014 uv.lock"}, "fullDescription": {"text": "python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.\n\nPackage: python-multipart\nInstalled: 0.0.27\nFixed in: 0.0.31\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.31"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48fdd935e384c638", "name": "CVE-2026-59890: setuptools 82.0.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-59890: setuptools 82.0.1 \u2014 uv.lock"}, "fullDescription": {"text": "setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)\n\nsetuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.\n\nPackage: setuptools\nInstalled: 82.0.1\nFixed in: 83.0.0\nSeverity: MEDIUM\nFix: Upgrade setuptools to 83.0.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3469805aacc55ee4", "name": "CVE-2026-49476: soupsieve 2.8.3 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-49476: soupsieve 2.8.3 \u2014 uv.lock"}, "fullDescription": {"text": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve allocates unbounded memory when compiling large comma-separated selector lists, allowing an attacker who can supply a crafted selector string to soupsieve.compile() or Beautiful Soup .select() / .select_one() to allocate hundreds of megabytes of heap memory from a relatively small input and cause denial of service. This issue is fixed in version 2.8.4.\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.8.4\nSeverity: HIGH\nFix: Upgrade soupsieve to 2.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-24c00bab279156b4", "name": "CVE-2026-49477: soupsieve 2.8.3 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-49477: soupsieve 2.8.3 \u2014 uv.lock"}, "fullDescription": {"text": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings\n\nSoup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.8.4, the CSS selector parser in soupsieve contains a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value in soupsieve/css_parser.py, allowing an attacker who can supply untrusted CSS selector strings to soupsieve.compile() or Beautiful Soup .select() / .select_one() to cause CPU exhaustion and denial of service. This issue is fi\n\nPackage: soupsieve\nInstalled: 2.8.3\nFixed in: 2.8.4\nSeverity: HIGH\nFix: Upgrade soupsieve to 2.8.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1918baaeda2a82e", "name": "CVE-2026-48818: starlette 0.52.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48818: starlette 0.52.1 \u2014 uv.lock"}, "fullDescription": {"text": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas\n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.1.0\nSeverity: HIGH\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fa7290bdf7d5e488", "name": "CVE-2026-54283: starlette 0.52.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54283: starlette 0.52.1 \u2014 uv.lock"}, "fullDescription": {"text": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS\n\nStarlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.3.1\nSeverity: HIGH\nFix: Upgrade starlette to 1.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-faf17bae7b85853f", "name": "CVE-2026-48710: starlette 0.52.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48710: starlette 0.52.1 \u2014 uv.lock"}, "fullDescription": {"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) \n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.0.1\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7ce42faf6fe55e8", "name": "CVE-2026-48817: starlette 0.52.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-48817: starlette 0.52.1 \u2014 uv.lock"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo\n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.1.0\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-914c66c6e81b6efd", "name": "CVE-2026-54282: starlette 0.52.1 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-54282: starlette 0.52.1 \u2014 uv.lock"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure due to improper HTTP request path validation\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header \n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.3.0\nSeverity: LOW\nFix: Upgrade starlette to 1.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1004df6c60dddfab", "name": "CVE-2025-3000: torch 2.10.0 \u2014 uv.lock", "shortDescription": {"text": "CVE-2025-3000: torch 2.10.0 \u2014 uv.lock"}, "fullDescription": {"text": "A vulnerability classified as critical has been found in PyTorch 2.6.0 ...\n\nA vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.\n\nPackage: torch\nInstalled: 2.10.0\nFixed in: 2.13.0\nSeverity: LOW\nFix: Upgrade torch to 2.13.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e9907f3d6ecddd1", "name": "CVE-2026-44431: urllib3 2.6.3 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-44431: urllib3 2.6.3 \u2014 uv.lock"}, "fullDescription": {"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers\n\nurllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.\n\nPackage: urllib3\nInstalled: 2.6.3\nFixed in: 2.7.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b91d7a02dcedfdc", "name": "CVE-2026-44432: urllib3 2.6.3 \u2014 uv.lock", "shortDescription": {"text": "CVE-2026-44432: urllib3 2.6.3 \u2014 uv.lock"}, "fullDescription": {"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression\n\nurllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly \n\nPackage: urllib3\nInstalled: 2.6.3\nFixed in: 2.7.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f8c4b4b284034ad7", "name": "SkillSpector TT3 (taint) in scripts/openwebui/seed_openwebui.py", "shortDescription": {"text": "SkillSpector TT3 (taint) in scripts/openwebui/seed_openwebui.py"}, "fullDescription": {"text": "with urllib.request.urlopen(req, timeout=timeout) as r:\n\nCredentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.\n\nSkill: unknown\nRule: TT3  Category: taint\nSeverity: CRITICAL  Confidence: 0.60\n\nRemediation: Never send credentials or environment variables over the network. Use secure credential stores and avoid transmitting secrets in request bodies or URLs."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.6}}, {"id": "scanner-34cfd0249405cc26", "name": "SkillSpector E1 (data-exfil) in SPECULATIVE.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in SPECULATIVE.md"}, "fullDescription": {"text": "curl -s http://127.0.0.1:8080/v1/chat/completions \\\n  -H 'Content-Type: application/json' \\\n  -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-3bb76de72c3d3eb4", "name": "SkillSpector E1 (data-exfil) in TOOLS.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in TOOLS.md"}, "fullDescription": {"text": "curl -s http://localhost:8080/v1/chat/completions -H \"Content-Type: application/json\" -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-7c26eedffbd88483", "name": "SkillSpector E2 (data-exfil) in scripts/download_models.sh", "shortDescription": {"text": "SkillSpector E2 (data-exfil) in scripts/download_models.sh"}, "fullDescription": {"text": "os.environ['BONSAI_TOKEN']\n\nCode accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.\n\nSkill: unknown\nRule: E2  Category: data-exfil\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Avoid reading sensitive env vars (API keys, tokens) unless strictly required. Use secrets managers or secure config. Never log or transmit credentials."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-2a56f830ed9f0053", "name": "SkillSpector E1 (data-exfil) in scripts/openwebui/tool_weather.py", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in scripts/openwebui/tool_weather.py"}, "fullDescription": {"text": "https://api.open-meteo.com/\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-5be89e0029b14418", "name": "SkillSpector E1 (data-exfil) in scripts/start_openwebui.sh", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in scripts/start_openwebui.sh"}, "fullDescription": {"text": "curl -fsS --max-time 1 \"http://localhost:$LLAMA_PORT/health\" >/dev/null 2>&1; then\n                break\n            fi\n            _tries=$((_tries + 1))\n            sleep 1\n        done\n        info\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: unknown\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-f3321f3de07fb846", "name": "SkillSpector EA3 (excessive-agency) in LICENSE", "shortDescription": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "fullDescription": {"text": "not limited to\n\nSkill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.\n\nSkill: unknown\nRule: EA3  Category: excessive-agency\nSeverity: LOW  Confidence: 0.70\n\nRemediation: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.7}}, {"id": "scanner-5644b1b2d11c100d", "name": "SkillSpector EA1 (excessive-agency) in OPENWEBUI.md", "shortDescription": {"text": "SkillSpector EA1 (excessive-agency) in OPENWEBUI.md"}, "fullDescription": {"text": "Tools:*\n\nSkill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.\n\nSkill: unknown\nRule: EA1  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Restrict tool access to only the tools required for the skill's stated purpose. Use an explicit allowlist rather than granting blanket access."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-47bcd8e80748ab21", "name": "SkillSpector PE2 (priv-esc) in .github/workflows/manual-platform-smoke.yml", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in .github/workflows/manual-platform-smoke.yml"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: unknown\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-6fcda7f990134fda", "name": "SkillSpector PE2 (priv-esc) in setup.sh", "shortDescription": {"text": "SkillSpector PE2 (priv-esc) in setup.sh"}, "fullDescription": {"text": "sudo\n\nCommands invoke sudo or root privileges. Verify this elevated access is necessary and justified.\n\nSkill: unknown\nRule: PE2  Category: priv-esc\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-24443690b47eade3", "name": "SkillSpector SC2 (supply-chain) in AGENTS.md", "shortDescription": {"text": "SkillSpector SC2 (supply-chain) in AGENTS.md"}, "fullDescription": {"text": "curl -s http://localhost:8080/props | python\n\nRemote code is downloaded and executed. This bypasses code review and could introduce malicious code.\n\nSkill: unknown\nRule: SC2  Category: supply-chain\nSeverity: HIGH  Confidence: 0.90\n\nRemediation: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c6c30ca9c7b69e40", "name": "SkillSpector SC4 (supply-chain) in pyproject.toml", "shortDescription": {"text": "SkillSpector SC4 (supply-chain) in pyproject.toml"}, "fullDescription": {"text": "requires-python\n\nDependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.\n\nSkill: unknown\nRule: SC4  Category: supply-chain\nSeverity: HIGH  Confidence: 0.80\n\nRemediation: Update the dependency to a patched version that addresses the known CVE. Check OSV (osv.dev) or NVD for details on the vulnerability."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.8}}, {"id": "scanner-f7de447c7a6e8bcb", "name": "SkillSpector TM2 (tool-misuse) in .github/workflows/manual-platform-smoke.yml", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in .github/workflows/manual-platform-smoke.yml"}, "fullDescription": {"text": "|\n          sudo\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: unknown\nRule: TM2  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.75\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-3578d0492aa1252f", "name": "SkillSpector TM1 (tool-misuse) in community-benchmarks/ternary-bonsai/cuda-rtx5060ti-linux.md", "shortDescription": {"text": "SkillSpector TM1 (tool-misuse) in community-benchmarks/ternary-bonsai/cuda-rtx5060ti-linux.md"}, "fullDescription": {"text": "rm --gpus all -e CUDA_VISIBLE_DEVICES=$GPU -v \"$D\":/w nvidia/\n\nTool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).\n\nSkill: unknown\nRule: TM1  Category: tool-misuse\nSeverity: LOW  Confidence: 0.15\n\nRemediation: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 0.15}}, {"id": "scanner-320b16d8c38144b8", "name": "SkillSpector TM2 (tool-misuse) in scripts/make_kv_bias.sh", "shortDescription": {"text": "SkillSpector TM2 (tool-misuse) in scripts/make_kv_bias.sh"}, "fullDescription": {"text": "&& rm -\n\nTool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.\n\nSkill: unknown\nRule: TM2  Category: tool-misuse\nSeverity: HIGH  Confidence: 0.75\n\nRemediation: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-0cf17dbb92a15ee1", "name": "SkillSpector TM3 (tool-misuse) in scripts/openwebui/seed_openwebui.py", "shortDescription": {"text": "SkillSpector TM3 (tool-misuse) in scripts/openwebui/seed_openwebui.py"}, "fullDescription": {"text": "AUTH=false\n\nTool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.\n\nSkill: unknown\nRule: TM3  Category: tool-misuse\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-88de2046641f8aa7", "name": "SkillSpector TM3 (tool-misuse) in scripts/start_openwebui.sh", "shortDescription": {"text": "SkillSpector TM3 (tool-misuse) in scripts/start_openwebui.sh"}, "fullDescription": {"text": "AUTH=false\n\nTool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.\n\nSkill: unknown\nRule: TM3  Category: tool-misuse\nSeverity: MEDIUM  Confidence: 0.75\n\nRemediation: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.75}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan . --format sarif --output skillspector-"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69fca261a0d42c04", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e635240c828830b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-367a8b193fa81cc2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 14 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9308cb1e3c0e2c58", "name": "Vulnerable dependency setuptools 82.0.1: GHSA-h35f-9h28-mq5c", "shortDescription": {"text": "Vulnerable dependency setuptools 82.0.1: GHSA-h35f-9h28-mq5c"}, "fullDescription": {"text": "OSV.dev reports `setuptools` at version `82.0.1` (resolved in `uv.lock`) is affected by GHSA-h35f-9h28-mq5c.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h35f-9h28-mq5c\nFix: upgrade `setuptools` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-670f503f21c3ae38", "name": "Vulnerable dependency setuptools 82.0.1: PYSEC-2026-3447", "shortDescription": {"text": "Vulnerable dependency setuptools 82.0.1: PYSEC-2026-3447"}, "fullDescription": {"text": "OSV.dev reports `setuptools` at version `82.0.1` (resolved in `uv.lock`) is affected by PYSEC-2026-3447.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3447\nFix: upgrade `setuptools` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-098d1276917805de", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-2fqr-mr3j-6wp8", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-2fqr-mr3j-6wp8"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-2fqr-mr3j-6wp8 (aka CVE-2026-54279).\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\naiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence\n\nAliases: CVE-2026-54279, PYSEC-2026-2112\nAdvisory: https://osv.dev/vulnerability/GHSA-2fqr-mr3j-6wp8\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ecdcc56410579a4f", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-4fvr-rgm6-gqmc", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-4fvr-rgm6-gqmc"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-4fvr-rgm6-gqmc (aka CVE-2026-54273).\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\naiohttp: HTTP/1 Pipelined Requests Queue Without Limit\n\nAliases: CVE-2026-54273, PYSEC-2026-2107\nAdvisory: https://osv.dev/vulnerability/GHSA-4fvr-rgm6-gqmc\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2f91dcc4d261e736", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-4m7w-qmgq-4wj5", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-4m7w-qmgq-4wj5"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-4m7w-qmgq-4wj5 (aka CVE-2026-54275).\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\naiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections\n\nAliases: CVE-2026-54275, PYSEC-2026-237\nAdvisory: https://osv.dev/vulnerability/GHSA-4m7w-qmgq-4wj5\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-37f565728c2333ab", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-63hw-fmq6-xxg2", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-63hw-fmq6-xxg2"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-63hw-fmq6-xxg2.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-63hw-fmq6-xxg2\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-81be790a4d3b9a0c", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-9x8q-7h8h-wcw9", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-9x8q-7h8h-wcw9"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-9x8q-7h8h-wcw9.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9x8q-7h8h-wcw9\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5a2b293ff21393c6", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-g3cq-j2xw-wf74", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-g3cq-j2xw-wf74"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-g3cq-j2xw-wf74.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g3cq-j2xw-wf74\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8344b71af369c361", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-hg6j-4rv6-33pg", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-hg6j-4rv6-33pg"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-hg6j-4rv6-33pg.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hg6j-4rv6-33pg\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fbd1b8de50cf0adf", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-hpj7-wq8m-9hgp", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-hpj7-wq8m-9hgp"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-hpj7-wq8m-9hgp.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hpj7-wq8m-9hgp\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-eb657a8d750092d4", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-jg22-mg44-37j8", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-jg22-mg44-37j8"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-jg22-mg44-37j8.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jg22-mg44-37j8\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b3b1a60e298e525f", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-m6qw-4cw2-hm4m", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-m6qw-4cw2-hm4m"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-m6qw-4cw2-hm4m.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m6qw-4cw2-hm4m\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d981acb375653d28", "name": "Vulnerable dependency aiohttp 3.13.5: GHSA-xcgm-r5h9-7989", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-xcgm-r5h9-7989"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by GHSA-xcgm-r5h9-7989.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xcgm-r5h9-7989\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a4478a7743d38a91", "name": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2104", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2104"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2104.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2104\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f6ffe398a8b33f86", "name": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2105", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2105"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2105.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2105\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a2c53ec5aa609511", "name": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2106", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2106"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2106.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2106\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6932515b23f6ae29", "name": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2108", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2108"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2108.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2108\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c495c5084118aed5", "name": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2109", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2109"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2109.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2109\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-298bf2631a76630c", "name": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2110", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2110"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2110.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2110\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6906c6f14cc6c9db", "name": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2111", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2111"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2111.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2111\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c0049664f3ddc66f", "name": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2113", "shortDescription": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2113"}, "fullDescription": {"text": "OSV.dev reports `aiohttp` at version `3.13.5` (resolved in `uv.lock`) is affected by PYSEC-2026-2113.\nNote: `aiohttp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2113\nFix: upgrade `aiohttp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c6061ea09adbdd50", "name": "Vulnerable dependency anthropic 0.86.0: GHSA-q5f5-3gjm-7mfm", "shortDescription": {"text": "Vulnerable dependency anthropic 0.86.0: GHSA-q5f5-3gjm-7mfm"}, "fullDescription": {"text": "OSV.dev reports `anthropic` at version `0.86.0` (resolved in `uv.lock`) is affected by GHSA-q5f5-3gjm-7mfm.\nNote: `anthropic` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q5f5-3gjm-7mfm\nFix: upgrade `anthropic` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-205d6720c29ffa77", "name": "Vulnerable dependency anthropic 0.86.0: GHSA-w828-4qhx-vxx3", "shortDescription": {"text": "Vulnerable dependency anthropic 0.86.0: GHSA-w828-4qhx-vxx3"}, "fullDescription": {"text": "OSV.dev reports `anthropic` at version `0.86.0` (resolved in `uv.lock`) is affected by GHSA-w828-4qhx-vxx3.\nNote: `anthropic` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w828-4qhx-vxx3\nFix: upgrade `anthropic` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2f51a5f7005214de", "name": "Vulnerable dependency anthropic 0.86.0: PYSEC-2026-2114", "shortDescription": {"text": "Vulnerable dependency anthropic 0.86.0: PYSEC-2026-2114"}, "fullDescription": {"text": "OSV.dev reports `anthropic` at version `0.86.0` (resolved in `uv.lock`) is affected by PYSEC-2026-2114.\nNote: `anthropic` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2114\nFix: upgrade `anthropic` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-67a82f50829b9e0e", "name": "Vulnerable dependency anthropic 0.86.0: PYSEC-2026-2115", "shortDescription": {"text": "Vulnerable dependency anthropic 0.86.0: PYSEC-2026-2115"}, "fullDescription": {"text": "OSV.dev reports `anthropic` at version `0.86.0` (resolved in `uv.lock`) is affected by PYSEC-2026-2115.\nNote: `anthropic` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2115\nFix: upgrade `anthropic` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3ff5ee577077b861", "name": "Vulnerable dependency chromadb 1.5.9: GHSA-f4j7-r4q5-qw2c", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.9: GHSA-f4j7-r4q5-qw2c"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.9` (resolved in `uv.lock`) is affected by GHSA-f4j7-r4q5-qw2c.\nNote: `chromadb` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f4j7-r4q5-qw2c\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-871f8acac193f16e", "name": "Vulnerable dependency chromadb 1.5.9: PYSEC-2026-311", "shortDescription": {"text": "Vulnerable dependency chromadb 1.5.9: PYSEC-2026-311"}, "fullDescription": {"text": "OSV.dev reports `chromadb` at version `1.5.9` (resolved in `uv.lock`) is affected by PYSEC-2026-311.\nNote: `chromadb` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-311\nFix: upgrade `chromadb` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5ad35f96d45e1160", "name": "Vulnerable dependency click 8.3.1: PYSEC-2026-2132", "shortDescription": {"text": "Vulnerable dependency click 8.3.1: PYSEC-2026-2132"}, "fullDescription": {"text": "OSV.dev reports `click` at version `8.3.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2132.\nNote: `click` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2132\nFix: upgrade `click` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ed38466448647c79", "name": "Vulnerable dependency cryptography 48.0.0: GHSA-537c-gmf6-5ccf", "shortDescription": {"text": "Vulnerable dependency cryptography 48.0.0: GHSA-537c-gmf6-5ccf"}, "fullDescription": {"text": "OSV.dev reports `cryptography` at version `48.0.0` (resolved in `uv.lock`) is affected by GHSA-537c-gmf6-5ccf.\nNote: `cryptography` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nVulnerable OpenSSL included in cryptography wheels\n\nAdvisory: https://osv.dev/vulnerability/GHSA-537c-gmf6-5ccf\nFix: upgrade `cryptography` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a02b1a6c81613bd0", "name": "Vulnerable dependency ecdsa 0.19.1: GHSA-9f5j-8jwj-x28g", "shortDescription": {"text": "Vulnerable dependency ecdsa 0.19.1: GHSA-9f5j-8jwj-x28g"}, "fullDescription": {"text": "OSV.dev reports `ecdsa` at version `0.19.1` (resolved in `uv.lock`) is affected by GHSA-9f5j-8jwj-x28g.\nNote: `ecdsa` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9f5j-8jwj-x28g\nFix: upgrade `ecdsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b48e4f3827a43f16", "name": "Vulnerable dependency ecdsa 0.19.1: GHSA-wj6h-64fc-37mp", "shortDescription": {"text": "Vulnerable dependency ecdsa 0.19.1: GHSA-wj6h-64fc-37mp"}, "fullDescription": {"text": "OSV.dev reports `ecdsa` at version `0.19.1` (resolved in `uv.lock`) is affected by GHSA-wj6h-64fc-37mp.\nNote: `ecdsa` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wj6h-64fc-37mp\nFix: upgrade `ecdsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2a2c68cd1310a8ac", "name": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-1325", "shortDescription": {"text": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-1325"}, "fullDescription": {"text": "OSV.dev reports `ecdsa` at version `0.19.1` (resolved in `uv.lock`) is affected by PYSEC-2026-1325.\nNote: `ecdsa` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1325\nFix: upgrade `ecdsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d7115ef0b6e73f1a", "name": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-2467", "shortDescription": {"text": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-2467"}, "fullDescription": {"text": "OSV.dev reports `ecdsa` at version `0.19.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2467.\nNote: `ecdsa` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2467\nFix: upgrade `ecdsa` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fe17a667e654d9a8", "name": "Vulnerable dependency httplib2 0.31.2: PYSEC-2026-3444", "shortDescription": {"text": "Vulnerable dependency httplib2 0.31.2: PYSEC-2026-3444"}, "fullDescription": {"text": "OSV.dev reports `httplib2` at version `0.31.2` (resolved in `uv.lock`) is affected by PYSEC-2026-3444.\nNote: `httplib2` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3444\nFix: upgrade `httplib2` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9eb78ac091ef83de", "name": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx", "shortDescription": {"text": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx"}, "fullDescription": {"text": "OSV.dev reports `idna` at version `3.11` (resolved in `uv.lock`) is affected by GHSA-65pc-fj4g-8rjx.\nNote: `idna` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-65pc-fj4g-8rjx\nFix: upgrade `idna` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-590d9f87a8f870cb", "name": "Vulnerable dependency idna 3.11: PYSEC-2026-215", "shortDescription": {"text": "Vulnerable dependency idna 3.11: PYSEC-2026-215"}, "fullDescription": {"text": "OSV.dev reports `idna` at version `3.11` (resolved in `uv.lock`) is affected by PYSEC-2026-215.\nNote: `idna` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-215\nFix: upgrade `idna` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b13f0be57598a48a", "name": "Vulnerable dependency langchain 1.2.10: GHSA-gr75-jv2w-4656", "shortDescription": {"text": "Vulnerable dependency langchain 1.2.10: GHSA-gr75-jv2w-4656"}, "fullDescription": {"text": "OSV.dev reports `langchain` at version `1.2.10` (resolved in `uv.lock`) is affected by GHSA-gr75-jv2w-4656.\nNote: `langchain` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gr75-jv2w-4656\nFix: upgrade `langchain` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e043e7b2d04baf68", "name": "Vulnerable dependency langchain 1.2.10: PYSEC-2026-2192", "shortDescription": {"text": "Vulnerable dependency langchain 1.2.10: PYSEC-2026-2192"}, "fullDescription": {"text": "OSV.dev reports `langchain` at version `1.2.10` (resolved in `uv.lock`) is affected by PYSEC-2026-2192.\nNote: `langchain` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2192\nFix: upgrade `langchain` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2e8c35f87a0a2cc4", "name": "Vulnerable dependency langgraph-checkpoint 4.0.1: GHSA-fjqc-hq36-qh5p", "shortDescription": {"text": "Vulnerable dependency langgraph-checkpoint 4.0.1: GHSA-fjqc-hq36-qh5p"}, "fullDescription": {"text": "OSV.dev reports `langgraph-checkpoint` at version `4.0.1` (resolved in `uv.lock`) is affected by GHSA-fjqc-hq36-qh5p.\nNote: `langgraph-checkpoint` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fjqc-hq36-qh5p\nFix: upgrade `langgraph-checkpoint` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4226853a400f74ab", "name": "Vulnerable dependency langgraph-checkpoint 4.0.1: PYSEC-2026-2573", "shortDescription": {"text": "Vulnerable dependency langgraph-checkpoint 4.0.1: PYSEC-2026-2573"}, "fullDescription": {"text": "OSV.dev reports `langgraph-checkpoint` at version `4.0.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2573.\nNote: `langgraph-checkpoint` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2573\nFix: upgrade `langgraph-checkpoint` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b266ce84b0c8ee89", "name": "Vulnerable dependency langgraph-sdk 0.3.12: GHSA-w39p-vh2g-g8g5", "shortDescription": {"text": "Vulnerable dependency langgraph-sdk 0.3.12: GHSA-w39p-vh2g-g8g5"}, "fullDescription": {"text": "OSV.dev reports `langgraph-sdk` at version `0.3.12` (resolved in `uv.lock`) is affected by GHSA-w39p-vh2g-g8g5.\nNote: `langgraph-sdk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w39p-vh2g-g8g5\nFix: upgrade `langgraph-sdk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2c7fd466f4809386", "name": "Vulnerable dependency langgraph-sdk 0.3.12: PYSEC-2026-2575", "shortDescription": {"text": "Vulnerable dependency langgraph-sdk 0.3.12: PYSEC-2026-2575"}, "fullDescription": {"text": "OSV.dev reports `langgraph-sdk` at version `0.3.12` (resolved in `uv.lock`) is affected by PYSEC-2026-2575.\nNote: `langgraph-sdk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2575\nFix: upgrade `langgraph-sdk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ea4188aa9aac1164", "name": "Vulnerable dependency langsmith 0.7.22: GHSA-3644-q5cj-c5c7", "shortDescription": {"text": "Vulnerable dependency langsmith 0.7.22: GHSA-3644-q5cj-c5c7"}, "fullDescription": {"text": "OSV.dev reports `langsmith` at version `0.7.22` (resolved in `uv.lock`) is affected by GHSA-3644-q5cj-c5c7 (aka CVE-2026-45134).\nNote: `langsmith` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nLangSmith SDK: Public prompt pull deserializes untrusted manifests without trust boundary warning\n\nAliases: CVE-2026-45134, PYSEC-2026-2555, PYSEC-2026-2560, PYSEC-2026-2582\nAdvisory: https://osv.dev/vulnerability/GHSA-3644-q5cj-c5c7\nFix: upgrade `langsmith` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-7e36a135b7acaee6", "name": "Vulnerable dependency langsmith 0.7.22: GHSA-f4xh-w4cj-qxq8", "shortDescription": {"text": "Vulnerable dependency langsmith 0.7.22: GHSA-f4xh-w4cj-qxq8"}, "fullDescription": {"text": "OSV.dev reports `langsmith` at version `0.7.22` (resolved in `uv.lock`) is affected by GHSA-f4xh-w4cj-qxq8.\nNote: `langsmith` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f4xh-w4cj-qxq8\nFix: upgrade `langsmith` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1e8bb21947a3b3cb", "name": "Vulnerable dependency langsmith 0.7.22: GHSA-rr7j-v2q5-chgv", "shortDescription": {"text": "Vulnerable dependency langsmith 0.7.22: GHSA-rr7j-v2q5-chgv"}, "fullDescription": {"text": "OSV.dev reports `langsmith` at version `0.7.22` (resolved in `uv.lock`) is affected by GHSA-rr7j-v2q5-chgv.\nNote: `langsmith` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rr7j-v2q5-chgv\nFix: upgrade `langsmith` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4266770a0f9b0ed2", "name": "Vulnerable dependency langsmith 0.7.22: PYSEC-2026-2583", "shortDescription": {"text": "Vulnerable dependency langsmith 0.7.22: PYSEC-2026-2583"}, "fullDescription": {"text": "OSV.dev reports `langsmith` at version `0.7.22` (resolved in `uv.lock`) is affected by PYSEC-2026-2583.\nNote: `langsmith` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2583\nFix: upgrade `langsmith` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-89b902dc4ed77162", "name": "Vulnerable dependency lxml 6.0.2: GHSA-vfmq-68hx-4jfw", "shortDescription": {"text": "Vulnerable dependency lxml 6.0.2: GHSA-vfmq-68hx-4jfw"}, "fullDescription": {"text": "OSV.dev reports `lxml` at version `6.0.2` (resolved in `uv.lock`) is affected by GHSA-vfmq-68hx-4jfw.\nNote: `lxml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vfmq-68hx-4jfw\nFix: upgrade `lxml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5e875ca6a80cd961", "name": "Vulnerable dependency lxml 6.0.2: PYSEC-2026-87", "shortDescription": {"text": "Vulnerable dependency lxml 6.0.2: PYSEC-2026-87"}, "fullDescription": {"text": "OSV.dev reports `lxml` at version `6.0.2` (resolved in `uv.lock`) is affected by PYSEC-2026-87.\nNote: `lxml` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-87\nFix: upgrade `lxml` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b62a87c757089d8c", "name": "Vulnerable dependency mako 1.3.10: GHSA-2h4p-vjrc-8xpq", "shortDescription": {"text": "Vulnerable dependency mako 1.3.10: GHSA-2h4p-vjrc-8xpq"}, "fullDescription": {"text": "OSV.dev reports `mako` at version `1.3.10` (resolved in `uv.lock`) is affected by GHSA-2h4p-vjrc-8xpq (aka CVE-2026-44307).\nNote: `mako` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nMako vulnerable to path traversal via backslash URI on Windows in TemplateLookup\n\nAliases: CVE-2026-44307, PYSEC-2026-2617\nAdvisory: https://osv.dev/vulnerability/GHSA-2h4p-vjrc-8xpq\nFix: upgrade `mako` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f6d773378806c33f", "name": "Vulnerable dependency mako 1.3.10: GHSA-v92g-xgxw-vvmm", "shortDescription": {"text": "Vulnerable dependency mako 1.3.10: GHSA-v92g-xgxw-vvmm"}, "fullDescription": {"text": "OSV.dev reports `mako` at version `1.3.10` (resolved in `uv.lock`) is affected by GHSA-v92g-xgxw-vvmm.\nNote: `mako` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v92g-xgxw-vvmm\nFix: upgrade `mako` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c60b5d7aa243c529", "name": "Vulnerable dependency mako 1.3.10: PYSEC-2026-88", "shortDescription": {"text": "Vulnerable dependency mako 1.3.10: PYSEC-2026-88"}, "fullDescription": {"text": "OSV.dev reports `mako` at version `1.3.10` (resolved in `uv.lock`) is affected by PYSEC-2026-88.\nNote: `mako` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-88\nFix: upgrade `mako` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9f00df8a75b13e35", "name": "Vulnerable dependency mcp 1.27.2: GHSA-vj7q-gjh5-988w", "shortDescription": {"text": "Vulnerable dependency mcp 1.27.2: GHSA-vj7q-gjh5-988w"}, "fullDescription": {"text": "OSV.dev reports `mcp` at version `1.27.2` (resolved in `uv.lock`) is affected by GHSA-vj7q-gjh5-988w.\nNote: `mcp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vj7q-gjh5-988w\nFix: upgrade `mcp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b3e39651c40f8829", "name": "Vulnerable dependency mcp 1.27.2: PYSEC-2026-3483", "shortDescription": {"text": "Vulnerable dependency mcp 1.27.2: PYSEC-2026-3483"}, "fullDescription": {"text": "OSV.dev reports `mcp` at version `1.27.2` (resolved in `uv.lock`) is affected by PYSEC-2026-3483.\nNote: `mcp` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3483\nFix: upgrade `mcp` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a7df66511c32e507", "name": "Vulnerable dependency nltk 3.9.4: GHSA-p4gq-832x-fm9v", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.4: GHSA-p4gq-832x-fm9v"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.4` (resolved in `uv.lock`) is affected by GHSA-p4gq-832x-fm9v.\nNote: `nltk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p4gq-832x-fm9v\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-89976e44e70ab5eb", "name": "Vulnerable dependency nltk 3.9.4: PYSEC-2026-2078", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.4: PYSEC-2026-2078"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.4` (resolved in `uv.lock`) is affected by PYSEC-2026-2078.\nNote: `nltk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2078\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-058fb440d8049bc8", "name": "Vulnerable dependency nltk 3.9.4: PYSEC-2026-597", "shortDescription": {"text": "Vulnerable dependency nltk 3.9.4: PYSEC-2026-597"}, "fullDescription": {"text": "OSV.dev reports `nltk` at version `3.9.4` (resolved in `uv.lock`) is affected by PYSEC-2026-597.\nNote: `nltk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-597\nFix: upgrade `nltk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6d995751454261a0", "name": "Vulnerable dependency pillow 12.2.0: GHSA-45hq-cxwh-f6vc", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-45hq-cxwh-f6vc"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-45hq-cxwh-f6vc (aka CVE-2026-55379).\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` \u2014 bomb protection bypass via font loading\n\nAliases: BIT-pillow-2026-55379, CVE-2026-55379, PYSEC-2026-2255\nAdvisory: https://osv.dev/vulnerability/GHSA-45hq-cxwh-f6vc\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f4b3942f75c39fb7", "name": "Vulnerable dependency pillow 12.2.0: GHSA-4x4j-2g7c-83w6", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-4x4j-2g7c-83w6"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-4x4j-2g7c-83w6 (aka CVE-2026-55798).\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPillow: WindowsViewer.get_command() OS command injection via unescaped shell path\n\nAliases: BIT-pillow-2026-55798, CVE-2026-55798, PYSEC-2026-2257\nAdvisory: https://osv.dev/vulnerability/GHSA-4x4j-2g7c-83w6\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-80d23e7e5cedc838", "name": "Vulnerable dependency pillow 12.2.0: GHSA-5x94-69rx-g8h2", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-5x94-69rx-g8h2"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-5x94-69rx-g8h2.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5x94-69rx-g8h2\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a709801af7061212", "name": "Vulnerable dependency pillow 12.2.0: GHSA-62p4-gmf7-7g93", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-62p4-gmf7-7g93"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-62p4-gmf7-7g93.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-62p4-gmf7-7g93\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2d488ecf384acbbd", "name": "Vulnerable dependency pillow 12.2.0: GHSA-6r8x-57c9-28j4", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-6r8x-57c9-28j4"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-6r8x-57c9-28j4.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6r8x-57c9-28j4\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-810121168c8feca0", "name": "Vulnerable dependency pillow 12.2.0: GHSA-8v84-f9pq-wr9x", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-8v84-f9pq-wr9x"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-8v84-f9pq-wr9x.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8v84-f9pq-wr9x\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-db7095c23c7d9a9a", "name": "Vulnerable dependency pillow 12.2.0: GHSA-9hw9-ch79-4vh6", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-9hw9-ch79-4vh6"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-9hw9-ch79-4vh6.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9hw9-ch79-4vh6\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3d62ce5d113f61c6", "name": "Vulnerable dependency pillow 12.2.0: GHSA-fj7v-r99m-22gq", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-fj7v-r99m-22gq"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-fj7v-r99m-22gq.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-fj7v-r99m-22gq\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6e768ea2475b0abc", "name": "Vulnerable dependency pillow 12.2.0: GHSA-jjj6-mw9f-p565", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-jjj6-mw9f-p565"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-jjj6-mw9f-p565.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jjj6-mw9f-p565\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-db12f1b7ea020c90", "name": "Vulnerable dependency pillow 12.2.0: GHSA-pg7v-jwj7-p798", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-pg7v-jwj7-p798"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-pg7v-jwj7-p798.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pg7v-jwj7-p798\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cddec2ecd753bafa", "name": "Vulnerable dependency pillow 12.2.0: GHSA-phj9-mv4w-65pm", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-phj9-mv4w-65pm"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-phj9-mv4w-65pm.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-phj9-mv4w-65pm\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-26640ec69704fbfc", "name": "Vulnerable dependency pillow 12.2.0: GHSA-vjc4-5qp5-m44j", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-vjc4-5qp5-m44j"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-vjc4-5qp5-m44j.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vjc4-5qp5-m44j\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-03da68e3c28d61c9", "name": "Vulnerable dependency pillow 12.2.0: GHSA-xj96-63gp-2gmr", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-xj96-63gp-2gmr"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by GHSA-xj96-63gp-2gmr.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-xj96-63gp-2gmr\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cf8c69fc45f30405", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2253", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2253"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-2253.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2253\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8627d30958e9fbe8", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2254", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2254"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-2254.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2254\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-bcacfbc7fc56fda4", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2256", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2256"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-2256.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2256\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-215db17939c2ee31", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3451", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3451"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3451.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3451\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5356a1862c74b797", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3452", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3452"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3452.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3452\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-50b1bb0ae9c15861", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3453", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3453"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3453.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3453\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-663897b47c6ca904", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3454", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3454"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3454.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3454\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9194377f7177c09c", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3493", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3493"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3493.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3493\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-85e936c145f21b1e", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3494", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3494"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3494.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3494\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-eaa2eaec8b31db52", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3495", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3495"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3495.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3495\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-aabac34917dd57fc", "name": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3496", "shortDescription": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3496"}, "fullDescription": {"text": "OSV.dev reports `pillow` at version `12.2.0` (resolved in `uv.lock`) is affected by PYSEC-2026-3496.\nNote: `pillow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3496\nFix: upgrade `pillow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-31e278ed2d614d1d", "name": "Vulnerable dependency pyarrow 20.0.0: GHSA-rgxp-2hwp-jwgg", "shortDescription": {"text": "Vulnerable dependency pyarrow 20.0.0: GHSA-rgxp-2hwp-jwgg"}, "fullDescription": {"text": "OSV.dev reports `pyarrow` at version `20.0.0` (resolved in `uv.lock`) is affected by GHSA-rgxp-2hwp-jwgg.\nNote: `pyarrow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rgxp-2hwp-jwgg\nFix: upgrade `pyarrow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ac7eab59ee4f3ae2", "name": "Vulnerable dependency pyarrow 20.0.0: PYSEC-2026-113", "shortDescription": {"text": "Vulnerable dependency pyarrow 20.0.0: PYSEC-2026-113"}, "fullDescription": {"text": "OSV.dev reports `pyarrow` at version `20.0.0` (resolved in `uv.lock`) is affected by PYSEC-2026-113.\nNote: `pyarrow` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-113\nFix: upgrade `pyarrow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4be8be837d3218a8", "name": "Vulnerable dependency pyasn1 0.6.3: GHSA-8ppf-4f7h-5ppj", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.3: GHSA-8ppf-4f7h-5ppj"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by GHSA-8ppf-4f7h-5ppj.\nNote: `pyasn1` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8ppf-4f7h-5ppj\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2a40b871965f1506", "name": "Vulnerable dependency pyasn1 0.6.3: GHSA-hm4w-wwcw-mr6r", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.3: GHSA-hm4w-wwcw-mr6r"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by GHSA-hm4w-wwcw-mr6r.\nNote: `pyasn1` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hm4w-wwcw-mr6r\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f8b7f5ba4fa43ada", "name": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3455", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3455"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3455.\nNote: `pyasn1` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3455\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8c025f6c1aee6ca0", "name": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3456", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3456"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3456.\nNote: `pyasn1` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3456\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9bbf32ae7157c304", "name": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3457", "shortDescription": {"text": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3457"}, "fullDescription": {"text": "OSV.dev reports `pyasn1` at version `0.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3457.\nNote: `pyasn1` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3457\nFix: upgrade `pyasn1` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-561199607badef54", "name": "Vulnerable dependency pydantic-settings 2.13.1: GHSA-4xgf-cpjx-pc3j", "shortDescription": {"text": "Vulnerable dependency pydantic-settings 2.13.1: GHSA-4xgf-cpjx-pc3j"}, "fullDescription": {"text": "OSV.dev reports `pydantic-settings` at version `2.13.1` (resolved in `uv.lock`) is affected by GHSA-4xgf-cpjx-pc3j (aka CVE-2026-58203).\nNote: `pydantic-settings` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size\n\nAliases: CVE-2026-58203\nAdvisory: https://osv.dev/vulnerability/GHSA-4xgf-cpjx-pc3j\nFix: upgrade `pydantic-settings` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2f35e24090839556", "name": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq", "shortDescription": {"text": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq"}, "fullDescription": {"text": "OSV.dev reports `pygments` at version `2.19.2` (resolved in `uv.lock`) is affected by GHSA-5239-wwwm-4pmq (aka CVE-2026-4539).\nNote: `pygments` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching\n\nAliases: CVE-2026-4539, PYSEC-2026-2987\nAdvisory: https://osv.dev/vulnerability/GHSA-5239-wwwm-4pmq\nFix: upgrade `pygments` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a50fa2ce80b32a71", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-248m-82v9-q6g6", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-248m-82v9-q6g6"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-248m-82v9-q6g6 (aka CVE-2026-48156).\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams\n\nAliases: CVE-2026-48156, PYSEC-2026-3004\nAdvisory: https://osv.dev/vulnerability/GHSA-248m-82v9-q6g6\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-972c63d8adbfabd0", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-3crg-w4f6-42mx", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-3crg-w4f6-42mx"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-3crg-w4f6-42mx (aka CVE-2026-40260).\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npypdf: Manipulated XMP metadata entity declarations can exhaust RAM\n\nAliases: CVE-2026-40260, PYSEC-2026-3006\nAdvisory: https://osv.dev/vulnerability/GHSA-3crg-w4f6-42mx\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b794b8fb2cd0df07", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-4pxv-j86v-mhcw", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-4pxv-j86v-mhcw"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-4pxv-j86v-mhcw (aka CVE-2026-41313).\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npypdf: Possible long runtimes for wrong size values in incremental mode\n\nAliases: CVE-2026-41313, PYSEC-2026-3007\nAdvisory: https://osv.dev/vulnerability/GHSA-4pxv-j86v-mhcw\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-7ecfa2d5ab179a94", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-52x6-gq3r-vpf4", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-52x6-gq3r-vpf4"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-52x6-gq3r-vpf4 (aka CVE-2026-54530).\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npypdf: Possible infinite loop when retrieving fonts for layout-mode text extraction\n\nAliases: CVE-2026-54530, PYSEC-2026-3009\nAdvisory: https://osv.dev/vulnerability/GHSA-52x6-gq3r-vpf4\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f5f42ed9ae66c574", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-55h5-xmcq-c37v", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-55h5-xmcq-c37v"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-55h5-xmcq-c37v (aka CVE-2026-59937).\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npypdf: Possible long runtimes for repeated malformed cross-reference entries\n\nAliases: CVE-2026-59937\nAdvisory: https://osv.dev/vulnerability/GHSA-55h5-xmcq-c37v\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7a1ab466da83d833", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-5hgr-hg42-57jg", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-5hgr-hg42-57jg"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-5hgr-hg42-57jg (aka CVE-2026-49460).\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npypdf: Inefficient decoding of FlateDecode PNG predictor streams\n\nAliases: CVE-2026-49460, PYSEC-2026-3010\nAdvisory: https://osv.dev/vulnerability/GHSA-5hgr-hg42-57jg\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-aaf485df2db62d5d", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-5qjq-93h5-hrgp", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-5qjq-93h5-hrgp"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-5qjq-93h5-hrgp (aka CVE-2026-59938).\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npypdf: Possible large memory usage for wrong image dimensions\n\nAliases: CVE-2026-59938\nAdvisory: https://osv.dev/vulnerability/GHSA-5qjq-93h5-hrgp\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-67188bf8db1a6acc", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-5xf7-4p34-54qr", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-5xf7-4p34-54qr"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-5xf7-4p34-54qr.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-5xf7-4p34-54qr\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8bea12871e78cb11", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-7gw9-cf7v-778f", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-7gw9-cf7v-778f"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-7gw9-cf7v-778f.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-7gw9-cf7v-778f\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d1984bb44e901eec", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-87mj-5ggw-8qc3", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-87mj-5ggw-8qc3"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-87mj-5ggw-8qc3.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-87mj-5ggw-8qc3\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-36b109996dde2ae4", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-cj93-chg6-vgv8", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-cj93-chg6-vgv8"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-cj93-chg6-vgv8.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cj93-chg6-vgv8\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cf1f8d563bbf087d", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-g867-7843-wf8q", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-g867-7843-wf8q"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-g867-7843-wf8q.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g867-7843-wf8q\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a6fa9b38ef4c08f5", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-g9xf-7f8q-9mcj", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-g9xf-7f8q-9mcj"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-g9xf-7f8q-9mcj.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g9xf-7f8q-9mcj\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e522ea9747056641", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-hqmh-ppp3-xvm7", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-hqmh-ppp3-xvm7"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-hqmh-ppp3-xvm7.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hqmh-ppp3-xvm7\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4cc1ddb65be1888f", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-j543-4vmf-qm7v", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-j543-4vmf-qm7v"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-j543-4vmf-qm7v.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j543-4vmf-qm7v\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ff8568c31bf7ffbf", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-jj6c-8h6c-hppx", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-jj6c-8h6c-hppx"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-jj6c-8h6c-hppx.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jj6c-8h6c-hppx\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-239a28dd9d1ff3bf", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-jm82-fx9c-mx94", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-jm82-fx9c-mx94"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-jm82-fx9c-mx94.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jm82-fx9c-mx94\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ae3f64a47cac38eb", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-m2v9-299j-rv96", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-m2v9-299j-rv96"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-m2v9-299j-rv96.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m2v9-299j-rv96\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7f76ae3d41383154", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-qpxp-75px-xjcp", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-qpxp-75px-xjcp"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-qpxp-75px-xjcp.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qpxp-75px-xjcp\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-26fce7a084669302", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-wjqc-6w8f-h24c", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-wjqc-6w8f-h24c"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-wjqc-6w8f-h24c.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wjqc-6w8f-h24c\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-48500fdf573a66a8", "name": "Vulnerable dependency pypdf 6.7.5: GHSA-x284-j5p8-9c5p", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-x284-j5p8-9c5p"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by GHSA-x284-j5p8-9c5p.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x284-j5p8-9c5p\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e2546f1df26cb592", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3011", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3011"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3011.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3011\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-22f0d52345f942bb", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3012", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3012"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3012.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3012\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4da3e67ad6095504", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3016", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3016"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3016.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3016\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-148ff56e75d2ddb9", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3018", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3018"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3018.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3018\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-57461f2624707fae", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3019", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3019"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3019.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3019\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f32720b2a6961bcf", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3020", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3020"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3020.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3020\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-27ddc14ba2be39e9", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3021", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3021"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3021.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3021\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6129d28c76b4a6a4", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3022", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3022"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3022.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3022\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-83bf467f52c1c5c2", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3023", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3023"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3023.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3023\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1372d1dcd98cf2be", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3025", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3025"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3025.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3025\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a4d6aee06a6af639", "name": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3026", "shortDescription": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3026"}, "fullDescription": {"text": "OSV.dev reports `pypdf` at version `6.7.5` (resolved in `uv.lock`) is affected by PYSEC-2026-3026.\nNote: `pypdf` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3026\nFix: upgrade `pypdf` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9a7600b42a45c10b", "name": "Vulnerable dependency python-multipart 0.0.27: GHSA-5rvq-cxj2-64vf", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.27: GHSA-5rvq-cxj2-64vf"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.27` (resolved in `uv.lock`) is affected by GHSA-5rvq-cxj2-64vf (aka CVE-2026-53539).\nNote: `python-multipart` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npython-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service\n\nAliases: CVE-2026-53539, PYSEC-2026-3036\nAdvisory: https://osv.dev/vulnerability/GHSA-5rvq-cxj2-64vf\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-657b7bde6424083a", "name": "Vulnerable dependency python-multipart 0.0.27: GHSA-6jv3-5f52-599m", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.27: GHSA-6jv3-5f52-599m"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.27` (resolved in `uv.lock`) is affected by GHSA-6jv3-5f52-599m.\nNote: `python-multipart` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6jv3-5f52-599m\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7e40b84f6d4e5095", "name": "Vulnerable dependency python-multipart 0.0.27: GHSA-v9pg-7xvm-68hf", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.27: GHSA-v9pg-7xvm-68hf"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.27` (resolved in `uv.lock`) is affected by GHSA-v9pg-7xvm-68hf.\nNote: `python-multipart` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v9pg-7xvm-68hf\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-588c009acf404c7e", "name": "Vulnerable dependency python-multipart 0.0.27: GHSA-vffw-93wf-4j4q", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.27: GHSA-vffw-93wf-4j4q"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.27` (resolved in `uv.lock`) is affected by GHSA-vffw-93wf-4j4q.\nNote: `python-multipart` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vffw-93wf-4j4q\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-11d4be7e61291b45", "name": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3037", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3037"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.27` (resolved in `uv.lock`) is affected by PYSEC-2026-3037.\nNote: `python-multipart` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3037\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ea20bcf5ec3ba094", "name": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3040", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3040"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.27` (resolved in `uv.lock`) is affected by PYSEC-2026-3040.\nNote: `python-multipart` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3040\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-febc604f7c574e01", "name": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3041", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3041"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.27` (resolved in `uv.lock`) is affected by PYSEC-2026-3041.\nNote: `python-multipart` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3041\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6e99059f40540132", "name": "Vulnerable dependency soupsieve 2.8.3: GHSA-2wc2-fm75-p42x", "shortDescription": {"text": "Vulnerable dependency soupsieve 2.8.3: GHSA-2wc2-fm75-p42x"}, "fullDescription": {"text": "OSV.dev reports `soupsieve` at version `2.8.3` (resolved in `uv.lock`) is affected by GHSA-2wc2-fm75-p42x (aka CVE-2026-49476).\nNote: `soupsieve` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nSoup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists\n\nAliases: CVE-2026-49476, PYSEC-2026-3071\nAdvisory: https://osv.dev/vulnerability/GHSA-2wc2-fm75-p42x\nFix: upgrade `soupsieve` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-f34ac0e4985e7ee4", "name": "Vulnerable dependency soupsieve 2.8.3: GHSA-836r-79rf-4m37", "shortDescription": {"text": "Vulnerable dependency soupsieve 2.8.3: GHSA-836r-79rf-4m37"}, "fullDescription": {"text": "OSV.dev reports `soupsieve` at version `2.8.3` (resolved in `uv.lock`) is affected by GHSA-836r-79rf-4m37.\nNote: `soupsieve` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-836r-79rf-4m37\nFix: upgrade `soupsieve` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d4fcbf73dcac901f", "name": "Vulnerable dependency soupsieve 2.8.3: PYSEC-2026-3072", "shortDescription": {"text": "Vulnerable dependency soupsieve 2.8.3: PYSEC-2026-3072"}, "fullDescription": {"text": "OSV.dev reports `soupsieve` at version `2.8.3` (resolved in `uv.lock`) is affected by PYSEC-2026-3072.\nNote: `soupsieve` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3072\nFix: upgrade `soupsieve` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f2c8013eb5eaff91", "name": "Vulnerable dependency starlette 0.52.1: GHSA-82w8-qh3p-5jfq", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-82w8-qh3p-5jfq"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-82w8-qh3p-5jfq.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-82w8-qh3p-5jfq\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5c15b30fde69ed75", "name": "Vulnerable dependency starlette 0.52.1: GHSA-86qp-5c8j-p5mr", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-86qp-5c8j-p5mr"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-86qp-5c8j-p5mr.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-86qp-5c8j-p5mr\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-68d456f086a60172", "name": "Vulnerable dependency starlette 0.52.1: GHSA-jp82-jpqv-5vv3", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-jp82-jpqv-5vv3"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-jp82-jpqv-5vv3.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jp82-jpqv-5vv3\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fc8f5ac9a4f33f8f", "name": "Vulnerable dependency starlette 0.52.1: GHSA-wqp7-x3pw-xc5r", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-wqp7-x3pw-xc5r"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-wqp7-x3pw-xc5r.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wqp7-x3pw-xc5r\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-7da100bb44b705f7", "name": "Vulnerable dependency starlette 0.52.1: GHSA-x746-7m8f-x49c", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-x746-7m8f-x49c"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by GHSA-x746-7m8f-x49c.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x746-7m8f-x49c\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d045151a0b52dfbd", "name": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-161", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-161"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-161.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-161\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-db597718539d655b", "name": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-2280", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-2280"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2280.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2280\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-526a1dd33e27d6f5", "name": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-2281", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-2281"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-2281.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2281\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-28608c156a1a234a", "name": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-248", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-248"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-248.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-248\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8ce24ff16c98d6d5", "name": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-249", "shortDescription": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-249"}, "fullDescription": {"text": "OSV.dev reports `starlette` at version `0.52.1` (resolved in `uv.lock`) is affected by PYSEC-2026-249.\nNote: `starlette` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-249\nFix: upgrade `starlette` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-598c14bfc13989e2", "name": "Vulnerable dependency torch 2.10.0: GHSA-rrmf-rvhw-rf47", "shortDescription": {"text": "Vulnerable dependency torch 2.10.0: GHSA-rrmf-rvhw-rf47"}, "fullDescription": {"text": "OSV.dev reports `torch` at version `2.10.0` (resolved in `uv.lock`) is affected by GHSA-rrmf-rvhw-rf47.\nNote: `torch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rrmf-rvhw-rf47\nFix: upgrade `torch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cd035c134e2bfaa7", "name": "Vulnerable dependency torch 2.10.0: PYSEC-2026-139", "shortDescription": {"text": "Vulnerable dependency torch 2.10.0: PYSEC-2026-139"}, "fullDescription": {"text": "OSV.dev reports `torch` at version `2.10.0` (resolved in `uv.lock`) is affected by PYSEC-2026-139.\nNote: `torch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-139\nFix: upgrade `torch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-47cc8878f0379db8", "name": "Vulnerable dependency urllib3 2.6.3: GHSA-mf9v-mfxr-j63j", "shortDescription": {"text": "Vulnerable dependency urllib3 2.6.3: GHSA-mf9v-mfxr-j63j"}, "fullDescription": {"text": "OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by GHSA-mf9v-mfxr-j63j.\nNote: `urllib3` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mf9v-mfxr-j63j\nFix: upgrade `urllib3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-433f57b90f387132", "name": "Vulnerable dependency urllib3 2.6.3: GHSA-qccp-gfcp-xxvc", "shortDescription": {"text": "Vulnerable dependency urllib3 2.6.3: GHSA-qccp-gfcp-xxvc"}, "fullDescription": {"text": "OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by GHSA-qccp-gfcp-xxvc.\nNote: `urllib3` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc\nFix: upgrade `urllib3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9a7d4ee40fdfda62", "name": "Vulnerable dependency urllib3 2.6.3: PYSEC-2026-141", "shortDescription": {"text": "Vulnerable dependency urllib3 2.6.3: PYSEC-2026-141"}, "fullDescription": {"text": "OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-141.\nNote: `urllib3` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-141\nFix: upgrade `urllib3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b0cc2808acdb73ab", "name": "Vulnerable dependency urllib3 2.6.3: PYSEC-2026-142", "shortDescription": {"text": "Vulnerable dependency urllib3 2.6.3: PYSEC-2026-142"}, "fullDescription": {"text": "OSV.dev reports `urllib3` at version `2.6.3` (resolved in `uv.lock`) is affected by PYSEC-2026-142.\nNote: `urllib3` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-142\nFix: upgrade `urllib3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30791"}, "properties": {"repository": "PrismML-Eng/Bonsai-demo", "repoUrl": "https://github.com/PrismML-Eng/Bonsai-demo", "branch": "main"}, "results": [{"ruleId": "scanner-998b1226f580efff", "level": "note", "message": {"text": "Possibly dead Python function: handle_startendtag"}, "properties": {"repobilityId": "259e69d47dc2412b", "scanner": "scanner-primary", "fingerprint": "998b1226f580efff", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/tool_web_fetch.py:131"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1e647768aa3bfd8", "level": "note", "message": {"text": "Possibly dead Python function: handle_data"}, "properties": {"repobilityId": "3a673a278f4fc1e6", "scanner": "scanner-primary", "fingerprint": "c1e647768aa3bfd8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/tool_web_fetch.py:135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc271bb50e9c5f9a", "level": "note", "message": {"text": "Possibly dead Python function: redirect_request"}, "properties": {"repobilityId": "95d749ff03fd48ea", "scanner": "scanner-primary", "fingerprint": "fc271bb50e9c5f9a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/tool_web_fetch.py:214"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c885058381ad4fe8", "level": "note", "message": {"text": "Possibly dead Python function: stream"}, "properties": {"repobilityId": "cd6b0a7c292eb1e8", "scanner": "scanner-primary", "fingerprint": "c885058381ad4fe8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/filter_mlx_stream.py:9"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c344f23eeb0465", "level": "note", "message": {"text": "Possibly dead Python function: execute_code"}, "properties": {"repobilityId": "917c9f376dc36793", "scanner": "scanner-primary", "fingerprint": "46c344f23eeb0465", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/tool_code_interpreter.py:150"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fae551a07c0593c5", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 scripts/openwebui/seed_openwebui.py:117"}, "properties": {"repobilityId": "f842be56be623794", "scanner": "scanner-primary", "fingerprint": "fae551a07c0593c5", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/seed_openwebui.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-9c70e844bf012cd0", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 scripts/openwebui/tool_weather.py:13"}, "properties": {"repobilityId": "9299df5d23c368c1", "scanner": "scanner-primary", "fingerprint": "9c70e844bf012cd0", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/tool_weather.py"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-7b1bd875f5a756b3", "level": "warning", "message": {"text": "CVE-2026-34993: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "e7977c365bb7bb0f", "scanner": "scanner-primary", "fingerprint": "7b1bd875f5a756b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34993"]}}, {"ruleId": "scanner-19c6593f77847057", "level": "warning", "message": {"text": "CVE-2026-47265: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "7035166482a6d084", "scanner": "scanner-primary", "fingerprint": "19c6593f77847057", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47265"]}}, {"ruleId": "scanner-38e2a20eca2f2493", "level": "warning", "message": {"text": "CVE-2026-54273: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "af0aae7929b420d3", "scanner": "scanner-primary", "fingerprint": "38e2a20eca2f2493", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54273"]}}, {"ruleId": "scanner-58146b01331e8e00", "level": "warning", "message": {"text": "CVE-2026-54274: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "7e10ded903752976", "scanner": "scanner-primary", "fingerprint": "58146b01331e8e00", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54274"]}}, {"ruleId": "scanner-6d92e64c021d9402", "level": "warning", "message": {"text": "CVE-2026-54276: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "4eb50b27324e7d60", "scanner": "scanner-primary", "fingerprint": "6d92e64c021d9402", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54276"]}}, {"ruleId": "scanner-b7f3bfdc15e643c2", "level": "warning", "message": {"text": "CVE-2026-54277: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "76d7edda54afad46", "scanner": "scanner-primary", "fingerprint": "b7f3bfdc15e643c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54277"]}}, {"ruleId": "scanner-d82cda415ed63e4f", "level": "warning", "message": {"text": "CVE-2026-54278: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "aebcc1b43ac4ed5e", "scanner": "scanner-primary", "fingerprint": "d82cda415ed63e4f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54278"]}}, {"ruleId": "scanner-e9846a76c6bf7076", "level": "note", "message": {"text": "CVE-2026-50269: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "ecf7a91f3d433ba8", "scanner": "scanner-primary", "fingerprint": "e9846a76c6bf7076", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-50269"]}}, {"ruleId": "scanner-866b1585aa5f6f03", "level": "note", "message": {"text": "CVE-2026-54275: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "151d3b178324b38a", "scanner": "scanner-primary", "fingerprint": "866b1585aa5f6f03", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54275"]}}, {"ruleId": "scanner-2e147b462d40fd8b", "level": "note", "message": {"text": "CVE-2026-54279: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "151a621396dd496c", "scanner": "scanner-primary", "fingerprint": "2e147b462d40fd8b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54279"]}}, {"ruleId": "scanner-80ceef5f98b6e284", "level": "note", "message": {"text": "CVE-2026-54280: aiohttp 3.13.5 \u2014 uv.lock"}, "properties": {"repobilityId": "79293d0b4dfc10d1", "scanner": "scanner-primary", "fingerprint": "80ceef5f98b6e284", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54280"]}}, {"ruleId": "scanner-b261b937a63691c0", "level": "warning", "message": {"text": "CVE-2026-34450: anthropic 0.86.0 \u2014 uv.lock"}, "properties": {"repobilityId": "f60ac2caaad2cb5f", "scanner": "scanner-primary", "fingerprint": "b261b937a63691c0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34450"]}}, {"ruleId": "scanner-cb188ad4bf2cafac", "level": "warning", "message": {"text": "CVE-2026-34452: anthropic 0.86.0 \u2014 uv.lock"}, "properties": {"repobilityId": "f6581da24960bfa3", "scanner": "scanner-primary", "fingerprint": "cb188ad4bf2cafac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34452"]}}, {"ruleId": "scanner-5def7cf2e2586c15", "level": "error", "message": {"text": "CVE-2026-45829: chromadb 1.5.9 \u2014 uv.lock"}, "properties": {"repobilityId": "9a9f2d0104652932", "scanner": "scanner-primary", "fingerprint": "5def7cf2e2586c15", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45829"]}}, {"ruleId": "scanner-1573ce9e96f794df", "level": "error", "message": {"text": "GHSA-537c-gmf6-5ccf: cryptography 48.0.0 \u2014 uv.lock"}, "properties": {"repobilityId": "a6d76544a3204701", "scanner": "scanner-primary", "fingerprint": "1573ce9e96f794df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-537c-gmf6-5ccf"]}}, {"ruleId": "scanner-2471f23cea2faf3b", "level": "error", "message": {"text": "CVE-2024-23342: ecdsa 0.19.1 \u2014 uv.lock"}, "properties": {"repobilityId": "ca3b4ef1754db1f5", "scanner": "scanner-primary", "fingerprint": "2471f23cea2faf3b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-23342"]}}, {"ruleId": "scanner-4d7700c60601a813", "level": "warning", "message": {"text": "CVE-2026-33936: ecdsa 0.19.1 \u2014 uv.lock"}, "properties": {"repobilityId": "a55f435e9dc3f1f7", "scanner": "scanner-primary", "fingerprint": "4d7700c60601a813", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33936"]}}, {"ruleId": "scanner-206a6aeb11dedddf", "level": "warning", "message": {"text": "CVE-2026-45409: idna 3.11 \u2014 uv.lock"}, "properties": {"repobilityId": "c2f0a4d128834c6b", "scanner": "scanner-primary", "fingerprint": "206a6aeb11dedddf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45409"]}}, {"ruleId": "scanner-a8a09cee990a383c", "level": "warning", "message": {"text": "CVE-2026-55443: langchain 1.2.10 \u2014 uv.lock"}, "properties": {"repobilityId": "d63962cbce4d7ea3", "scanner": "scanner-primary", "fingerprint": "a8a09cee990a383c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55443"]}}, {"ruleId": "scanner-674f962168d09333", "level": "warning", "message": {"text": "CVE-2026-48775: langgraph-checkpoint 4.0.1 \u2014 uv.lock"}, "properties": {"repobilityId": "25b1fc6d1abf6a91", "scanner": "scanner-primary", "fingerprint": "674f962168d09333", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48775"]}}, {"ruleId": "scanner-4efa954f96da41bc", "level": "warning", "message": {"text": "CVE-2026-48776: langgraph-sdk 0.3.12 \u2014 uv.lock"}, "properties": {"repobilityId": "87b114e3ba5c0712", "scanner": "scanner-primary", "fingerprint": "4efa954f96da41bc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48776"]}}, {"ruleId": "scanner-4ffb4c314812f696", "level": "error", "message": {"text": "CVE-2026-45134: langsmith 0.7.22 \u2014 uv.lock"}, "properties": {"repobilityId": "67daabc3f3f8a7c7", "scanner": "scanner-primary", "fingerprint": "4ffb4c314812f696", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45134"]}}, {"ruleId": "scanner-4b1ad8a41f6f201a", "level": "error", "message": {"text": "GHSA-f4xh-w4cj-qxq8: langsmith 0.7.22 \u2014 uv.lock"}, "properties": {"repobilityId": "efbb73d3627413e3", "scanner": "scanner-primary", "fingerprint": "4b1ad8a41f6f201a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f4xh-w4cj-qxq8"]}}, {"ruleId": "scanner-0c72ee6859586413", "level": "warning", "message": {"text": "CVE-2026-41182: langsmith 0.7.22 \u2014 uv.lock"}, "properties": {"repobilityId": "1de7ded2559e72c2", "scanner": "scanner-primary", "fingerprint": "0c72ee6859586413", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41182"]}}, {"ruleId": "scanner-6cc76acfbf412673", "level": "error", "message": {"text": "CVE-2026-41066: lxml 6.0.2 \u2014 uv.lock"}, "properties": {"repobilityId": "77f44c11028da546", "scanner": "scanner-primary", "fingerprint": "6cc76acfbf412673", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41066"]}}, {"ruleId": "scanner-0589c026896ab41d", "level": "error", "message": {"text": "CVE-2026-41205: mako 1.3.10 \u2014 uv.lock"}, "properties": {"repobilityId": "8bab31d6fda421da", "scanner": "scanner-primary", "fingerprint": "0589c026896ab41d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41205"]}}, {"ruleId": "scanner-a9ad76807ad5bd77", "level": "error", "message": {"text": "CVE-2026-44307: mako 1.3.10 \u2014 uv.lock"}, "properties": {"repobilityId": "29b96018644aa94b", "scanner": "scanner-primary", "fingerprint": "a9ad76807ad5bd77", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44307"]}}, {"ruleId": "scanner-3bee0e51d6b49ef1", "level": "error", "message": {"text": "CVE-2026-59950: mcp 1.27.2 \u2014 uv.lock"}, "properties": {"repobilityId": "72bb20114a795fd4", "scanner": "scanner-primary", "fingerprint": "3bee0e51d6b49ef1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59950"]}}, {"ruleId": "scanner-0b2ce8cfd087191f", "level": "error", "message": {"text": "CVE-2026-54293: nltk 3.9.4 \u2014 uv.lock"}, "properties": {"repobilityId": "325d2a0c3ba00dfe", "scanner": "scanner-primary", "fingerprint": "0b2ce8cfd087191f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54293"]}}, {"ruleId": "scanner-9737b39b2a7551a7", "level": "error", "message": {"text": "CVE-2026-54058: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "ad6b9031837af19d", "scanner": "scanner-primary", "fingerprint": "9737b39b2a7551a7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54058"]}}, {"ruleId": "scanner-92f5952034493030", "level": "error", "message": {"text": "CVE-2026-54059: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "4fd6401261d7b673", "scanner": "scanner-primary", "fingerprint": "92f5952034493030", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54059"]}}, {"ruleId": "scanner-1ff9f66ba430e736", "level": "error", "message": {"text": "CVE-2026-54060: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "460c3dd8de6beb2a", "scanner": "scanner-primary", "fingerprint": "1ff9f66ba430e736", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54060"]}}, {"ruleId": "scanner-6c85e0cc00b91ed7", "level": "error", "message": {"text": "CVE-2026-55379: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "41cc2c5cfa0ab3e7", "scanner": "scanner-primary", "fingerprint": "6c85e0cc00b91ed7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55379"]}}, {"ruleId": "scanner-0b2568d3cbcb767f", "level": "error", "message": {"text": "CVE-2026-55380: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "f90615a9989f57bc", "scanner": "scanner-primary", "fingerprint": "0b2568d3cbcb767f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55380"]}}, {"ruleId": "scanner-8f83941fee577645", "level": "error", "message": {"text": "CVE-2026-59197: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "b4fa5d22b574d8f3", "scanner": "scanner-primary", "fingerprint": "8f83941fee577645", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59197"]}}, {"ruleId": "scanner-5e268c1133819fbf", "level": "error", "message": {"text": "CVE-2026-59199: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "1c3986517b685ff4", "scanner": "scanner-primary", "fingerprint": "5e268c1133819fbf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59199"]}}, {"ruleId": "scanner-8297d3abcb7190eb", "level": "error", "message": {"text": "CVE-2026-59200: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "278253220173941f", "scanner": "scanner-primary", "fingerprint": "8297d3abcb7190eb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59200"]}}, {"ruleId": "scanner-3f4c42d809f3d4d4", "level": "error", "message": {"text": "CVE-2026-59204: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "ad08bb4154b8a7b2", "scanner": "scanner-primary", "fingerprint": "3f4c42d809f3d4d4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59204"]}}, {"ruleId": "scanner-4254579d8b441828", "level": "error", "message": {"text": "CVE-2026-59205: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "cc9b1626466d8587", "scanner": "scanner-primary", "fingerprint": "4254579d8b441828", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59205"]}}, {"ruleId": "scanner-eee5d94fc3e70870", "level": "warning", "message": {"text": "CVE-2026-55798: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "d0d151cc4785c963", "scanner": "scanner-primary", "fingerprint": "eee5d94fc3e70870", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-55798"]}}, {"ruleId": "scanner-027941125df659f6", "level": "warning", "message": {"text": "CVE-2026-59198: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "4b734d961778b7aa", "scanner": "scanner-primary", "fingerprint": "027941125df659f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59198"]}}, {"ruleId": "scanner-bff8feb430b5016c", "level": "warning", "message": {"text": "CVE-2026-59203: pillow 12.2.0 \u2014 uv.lock"}, "properties": {"repobilityId": "23f54ff1326a45d7", "scanner": "scanner-primary", "fingerprint": "bff8feb430b5016c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59203"]}}, {"ruleId": "scanner-90d30c42276a0d32", "level": "error", "message": {"text": "CVE-2026-25087: pyarrow 20.0.0 \u2014 uv.lock"}, "properties": {"repobilityId": "62a5e5f986c14ee0", "scanner": "scanner-primary", "fingerprint": "90d30c42276a0d32", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25087"]}}, {"ruleId": "scanner-0bf4b6732214b3f2", "level": "error", "message": {"text": "CVE-2026-59885: pyasn1 0.6.3 \u2014 uv.lock"}, "properties": {"repobilityId": "01feb8e00c6b8d6d", "scanner": "scanner-primary", "fingerprint": "0bf4b6732214b3f2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59885"]}}, {"ruleId": "scanner-988094facb9cf24b", "level": "error", "message": {"text": "CVE-2026-59886: pyasn1 0.6.3 \u2014 uv.lock"}, "properties": {"repobilityId": "f14e1a039e252f5b", "scanner": "scanner-primary", "fingerprint": "988094facb9cf24b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59886"]}}, {"ruleId": "scanner-2c9f940291de2b45", "level": "warning", "message": {"text": "GHSA-4xgf-cpjx-pc3j: pydantic-settings 2.13.1 \u2014 uv.lock"}, "properties": {"repobilityId": "c882a46b2faaf478", "scanner": "scanner-primary", "fingerprint": "2c9f940291de2b45", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-4xgf-cpjx-pc3j"]}}, {"ruleId": "scanner-0da8a15114591082", "level": "note", "message": {"text": "CVE-2026-4539: pygments 2.19.2 \u2014 uv.lock"}, "properties": {"repobilityId": "f9fcbb5336951446", "scanner": "scanner-primary", "fingerprint": "0da8a15114591082", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4539"]}}, {"ruleId": "scanner-f94af0b7a786f230", "level": "warning", "message": {"text": "CVE-2026-31826: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "3332fa22139bdc3c", "scanner": "scanner-primary", "fingerprint": "f94af0b7a786f230", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-31826"]}}, {"ruleId": "scanner-0484fcf12807a249", "level": "warning", "message": {"text": "CVE-2026-33123: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "fb85d477f9df3a86", "scanner": "scanner-primary", "fingerprint": "0484fcf12807a249", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33123"]}}, {"ruleId": "scanner-8005a9a0478b520c", "level": "warning", "message": {"text": "CVE-2026-33699: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "a644296700a2aff4", "scanner": "scanner-primary", "fingerprint": "8005a9a0478b520c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-33699"]}}, {"ruleId": "scanner-765cbeb01cbb8fa5", "level": "warning", "message": {"text": "CVE-2026-40260: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "2314006ee7287b8c", "scanner": "scanner-primary", "fingerprint": "765cbeb01cbb8fa5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40260"]}}, {"ruleId": "scanner-ad68b84f796b5064", "level": "warning", "message": {"text": "CVE-2026-41168: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "171f234b3f1e2bb8", "scanner": "scanner-primary", "fingerprint": "ad68b84f796b5064", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41168"]}}, {"ruleId": "scanner-7205aff6de40498f", "level": "warning", "message": {"text": "CVE-2026-41312: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "f045e5583e6423d7", "scanner": "scanner-primary", "fingerprint": "7205aff6de40498f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41312"]}}, {"ruleId": "scanner-a92b10fe35288858", "level": "warning", "message": {"text": "CVE-2026-41313: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "65a727c42e14f169", "scanner": "scanner-primary", "fingerprint": "a92b10fe35288858", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41313"]}}, {"ruleId": "scanner-d2de054d46dd97fb", "level": "warning", "message": {"text": "CVE-2026-41314: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "5f04a2cfe8cd3b9b", "scanner": "scanner-primary", "fingerprint": "d2de054d46dd97fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41314"]}}, {"ruleId": "scanner-1d8ba13a957c7e67", "level": "warning", "message": {"text": "CVE-2026-48155: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "cb18778d33c66c8d", "scanner": "scanner-primary", "fingerprint": "1d8ba13a957c7e67", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48155"]}}, {"ruleId": "scanner-062e893e387131c2", "level": "warning", "message": {"text": "CVE-2026-48156: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "e90b0011d101deba", "scanner": "scanner-primary", "fingerprint": "062e893e387131c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48156"]}}, {"ruleId": "scanner-34102fca5df6b14b", "level": "warning", "message": {"text": "CVE-2026-48735: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "4280773aab45e598", "scanner": "scanner-primary", "fingerprint": "34102fca5df6b14b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48735"]}}, {"ruleId": "scanner-cf605bb88103bf25", "level": "warning", "message": {"text": "CVE-2026-49460: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "8ee71cdd2d06e801", "scanner": "scanner-primary", "fingerprint": "cf605bb88103bf25", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49460"]}}, {"ruleId": "scanner-c0eb2de74a7410a7", "level": "warning", "message": {"text": "CVE-2026-49461: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "7d5831aead56734f", "scanner": "scanner-primary", "fingerprint": "c0eb2de74a7410a7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49461"]}}, {"ruleId": "scanner-f1912a02fa197423", "level": "warning", "message": {"text": "CVE-2026-54530: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "2977b3f0e26bdfcb", "scanner": "scanner-primary", "fingerprint": "f1912a02fa197423", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54530"]}}, {"ruleId": "scanner-3d83a50184be8ffb", "level": "warning", "message": {"text": "CVE-2026-54531: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "fdd238ff6812a0bc", "scanner": "scanner-primary", "fingerprint": "3d83a50184be8ffb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54531"]}}, {"ruleId": "scanner-6b14f220c2e57a48", "level": "warning", "message": {"text": "CVE-2026-54651: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "d0c24b75be94df40", "scanner": "scanner-primary", "fingerprint": "6b14f220c2e57a48", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54651"]}}, {"ruleId": "scanner-1af24325312cd7f8", "level": "warning", "message": {"text": "GHSA-jm82-fx9c-mx94: pypdf 6.7.5 \u2014 uv.lock"}, "properties": {"repobilityId": "e4110bdb63a03d52", "scanner": "scanner-primary", "fingerprint": "1af24325312cd7f8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-jm82-fx9c-mx94"]}}, {"ruleId": "scanner-0424664fd0e0e4ab", "level": "error", "message": {"text": "CVE-2026-53539: python-multipart 0.0.27 \u2014 uv.lock"}, "properties": {"repobilityId": "25b2742cc7a21766", "scanner": "scanner-primary", "fingerprint": "0424664fd0e0e4ab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53539"]}}, {"ruleId": "scanner-4376ea905d85267f", "level": "note", "message": {"text": "CVE-2026-53537: python-multipart 0.0.27 \u2014 uv.lock"}, "properties": {"repobilityId": "f480cda055939429", "scanner": "scanner-primary", "fingerprint": "4376ea905d85267f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53537"]}}, {"ruleId": "scanner-0c50601e749d9bf4", "level": "note", "message": {"text": "CVE-2026-53538: python-multipart 0.0.27 \u2014 uv.lock"}, "properties": {"repobilityId": "2458c0fb8d686551", "scanner": "scanner-primary", "fingerprint": "0c50601e749d9bf4", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53538"]}}, {"ruleId": "scanner-b650d0feb8010a93", "level": "note", "message": {"text": "CVE-2026-53540: python-multipart 0.0.27 \u2014 uv.lock"}, "properties": {"repobilityId": "68c69c7c120812e6", "scanner": "scanner-primary", "fingerprint": "b650d0feb8010a93", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53540"]}}, {"ruleId": "scanner-48fdd935e384c638", "level": "warning", "message": {"text": "CVE-2026-59890: setuptools 82.0.1 \u2014 uv.lock"}, "properties": {"repobilityId": "e9190b412dfee1c0", "scanner": "scanner-primary", "fingerprint": "48fdd935e384c638", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59890"]}}, {"ruleId": "scanner-3469805aacc55ee4", "level": "error", "message": {"text": "CVE-2026-49476: soupsieve 2.8.3 \u2014 uv.lock"}, "properties": {"repobilityId": "fcce8cd182558fad", "scanner": "scanner-primary", "fingerprint": "3469805aacc55ee4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49476"]}}, {"ruleId": "scanner-24c00bab279156b4", "level": "error", "message": {"text": "CVE-2026-49477: soupsieve 2.8.3 \u2014 uv.lock"}, "properties": {"repobilityId": "b318f8166b5ef45b", "scanner": "scanner-primary", "fingerprint": "24c00bab279156b4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49477"]}}, {"ruleId": "scanner-c1918baaeda2a82e", "level": "error", "message": {"text": "CVE-2026-48818: starlette 0.52.1 \u2014 uv.lock"}, "properties": {"repobilityId": "5fd9b65620eff6b1", "scanner": "scanner-primary", "fingerprint": "c1918baaeda2a82e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48818"]}}, {"ruleId": "scanner-fa7290bdf7d5e488", "level": "error", "message": {"text": "CVE-2026-54283: starlette 0.52.1 \u2014 uv.lock"}, "properties": {"repobilityId": "a28cb20663a761ec", "scanner": "scanner-primary", "fingerprint": "fa7290bdf7d5e488", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54283"]}}, {"ruleId": "scanner-faf17bae7b85853f", "level": "warning", "message": {"text": "CVE-2026-48710: starlette 0.52.1 \u2014 uv.lock"}, "properties": {"repobilityId": "e8ddf94c396d6dd1", "scanner": "scanner-primary", "fingerprint": "faf17bae7b85853f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48710"]}}, {"ruleId": "scanner-c7ce42faf6fe55e8", "level": "warning", "message": {"text": "CVE-2026-48817: starlette 0.52.1 \u2014 uv.lock"}, "properties": {"repobilityId": "315c33072892be6b", "scanner": "scanner-primary", "fingerprint": "c7ce42faf6fe55e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48817"]}}, {"ruleId": "scanner-914c66c6e81b6efd", "level": "note", "message": {"text": "CVE-2026-54282: starlette 0.52.1 \u2014 uv.lock"}, "properties": {"repobilityId": "9b07991a62551363", "scanner": "scanner-primary", "fingerprint": "914c66c6e81b6efd", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54282"]}}, {"ruleId": "scanner-1004df6c60dddfab", "level": "note", "message": {"text": "CVE-2025-3000: torch 2.10.0 \u2014 uv.lock"}, "properties": {"repobilityId": "bffa8b22ac5138b3", "scanner": "scanner-primary", "fingerprint": "1004df6c60dddfab", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-3000"]}}, {"ruleId": "scanner-9e9907f3d6ecddd1", "level": "error", "message": {"text": "CVE-2026-44431: urllib3 2.6.3 \u2014 uv.lock"}, "properties": {"repobilityId": "3621668d4ee670ac", "scanner": "scanner-primary", "fingerprint": "9e9907f3d6ecddd1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44431"]}}, {"ruleId": "scanner-4b91d7a02dcedfdc", "level": "error", "message": {"text": "CVE-2026-44432: urllib3 2.6.3 \u2014 uv.lock"}, "properties": {"repobilityId": "1ba97cfd649d1477", "scanner": "scanner-primary", "fingerprint": "4b91d7a02dcedfdc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44432"]}}, {"ruleId": "scanner-f8c4b4b284034ad7", "level": "error", "message": {"text": "SkillSpector TT3 (taint) in scripts/openwebui/seed_openwebui.py"}, "properties": {"repobilityId": "ebd27fca1a2f4740", "scanner": "scanner-primary", "fingerprint": "f8c4b4b284034ad7", "layer": "security", "severity": "critical", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "taint", "TT3", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/seed_openwebui.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-34cfd0249405cc26", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in SPECULATIVE.md"}, "properties": {"repobilityId": "3eb9a14cde2eb132", "scanner": "scanner-primary", "fingerprint": "34cfd0249405cc26", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "SPECULATIVE.md"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-3bb76de72c3d3eb4", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in TOOLS.md"}, "properties": {"repobilityId": "65881e6bb7bd1dee", "scanner": "scanner-primary", "fingerprint": "3bb76de72c3d3eb4", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "TOOLS.md"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-7c26eedffbd88483", "level": "error", "message": {"text": "SkillSpector E2 (data-exfil) in scripts/download_models.sh"}, "properties": {"repobilityId": "500d1306b6ed8c79", "scanner": "scanner-primary", "fingerprint": "7c26eedffbd88483", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "data-exfil", "E2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/download_models.sh"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-2a56f830ed9f0053", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in scripts/openwebui/tool_weather.py"}, "properties": {"repobilityId": "87a6c6991ce7cd71", "scanner": "scanner-primary", "fingerprint": "2a56f830ed9f0053", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/tool_weather.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-5be89e0029b14418", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in scripts/start_openwebui.sh"}, "properties": {"repobilityId": "b1c614794dcf6432", "scanner": "scanner-primary", "fingerprint": "5be89e0029b14418", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/start_openwebui.sh"}, "region": {"startLine": 197}}}]}, {"ruleId": "scanner-f3321f3de07fb846", "level": "note", "message": {"text": "SkillSpector EA3 (excessive-agency) in LICENSE"}, "properties": {"repobilityId": "1b29968a80e56e5c", "scanner": "scanner-primary", "fingerprint": "f3321f3de07fb846", "layer": "security", "severity": "low", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "LICENSE"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-5644b1b2d11c100d", "level": "warning", "message": {"text": "SkillSpector EA1 (excessive-agency) in OPENWEBUI.md"}, "properties": {"repobilityId": "cce7ec66aeb2d204", "scanner": "scanner-primary", "fingerprint": "5644b1b2d11c100d", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "OPENWEBUI.md"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-47bcd8e80748ab21", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in .github/workflows/manual-platform-smoke.yml"}, "properties": {"repobilityId": "e9a1c546c754781d", "scanner": "scanner-primary", "fingerprint": "47bcd8e80748ab21", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-platform-smoke.yml"}, "region": {"startLine": 306}}}]}, {"ruleId": "scanner-6fcda7f990134fda", "level": "warning", "message": {"text": "SkillSpector PE2 (priv-esc) in setup.sh"}, "properties": {"repobilityId": "cf29aa1f2613ad0c", "scanner": "scanner-primary", "fingerprint": "6fcda7f990134fda", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "priv-esc", "PE2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "setup.sh"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-24443690b47eade3", "level": "error", "message": {"text": "SkillSpector SC2 (supply-chain) in AGENTS.md"}, "properties": {"repobilityId": "1ac3135b8839555b", "scanner": "scanner-primary", "fingerprint": "24443690b47eade3", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 181}}}]}, {"ruleId": "scanner-c6c30ca9c7b69e40", "level": "error", "message": {"text": "SkillSpector SC4 (supply-chain) in pyproject.toml"}, "properties": {"repobilityId": "c14f294691562be9", "scanner": "scanner-primary", "fingerprint": "c6c30ca9c7b69e40", "layer": "security", "severity": "high", "confidence": 0.8, "tags": ["skillspector", "mcp-skill", "supply-chain", "SC4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-f7de447c7a6e8bcb", "level": "error", "message": {"text": "SkillSpector TM2 (tool-misuse) in .github/workflows/manual-platform-smoke.yml"}, "properties": {"repobilityId": "8203bc45642a4b47", "scanner": "scanner-primary", "fingerprint": "f7de447c7a6e8bcb", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-platform-smoke.yml"}, "region": {"startLine": 305}}}]}, {"ruleId": "scanner-3578d0492aa1252f", "level": "note", "message": {"text": "SkillSpector TM1 (tool-misuse) in community-benchmarks/ternary-bonsai/cuda-rtx5060ti-linux.md"}, "properties": {"repobilityId": "7a928c9995f538f5", "scanner": "scanner-primary", "fingerprint": "3578d0492aa1252f", "layer": "security", "severity": "low", "confidence": 0.15, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "community-benchmarks/ternary-bonsai/cuda-rtx5060ti-linux.md"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-320b16d8c38144b8", "level": "error", "message": {"text": "SkillSpector TM2 (tool-misuse) in scripts/make_kv_bias.sh"}, "properties": {"repobilityId": "7016fe09d1315da3", "scanner": "scanner-primary", "fingerprint": "320b16d8c38144b8", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/make_kv_bias.sh"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-0cf17dbb92a15ee1", "level": "warning", "message": {"text": "SkillSpector TM3 (tool-misuse) in scripts/openwebui/seed_openwebui.py"}, "properties": {"repobilityId": "43a9d8eabbc85d5b", "scanner": "scanner-primary", "fingerprint": "0cf17dbb92a15ee1", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/openwebui/seed_openwebui.py"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-88de2046641f8aa7", "level": "warning", "message": {"text": "SkillSpector TM3 (tool-misuse) in scripts/start_openwebui.sh"}, "properties": {"repobilityId": "876d27789f75a90a", "scanner": "scanner-primary", "fingerprint": "88de2046641f8aa7", "layer": "security", "severity": "medium", "confidence": 0.75, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/start_openwebui.sh"}, "region": {"startLine": 305}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-69fca261a0d42c04", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0d0cd2dcf5b0e1f2", "scanner": "scanner-primary", "fingerprint": "69fca261a0d42c04", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/manual-platform-smoke.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-3e635240c828830b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "db3b968ffae4c4ba", "scanner": "scanner-primary", "fingerprint": "3e635240c828830b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-from-source-smoke.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-367a8b193fa81cc2", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ae81d40587cc66b", "scanner": "scanner-primary", "fingerprint": "367a8b193fa81cc2", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check-no-em-dashes.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "44be246bb4e80608", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-9308cb1e3c0e2c58", "level": "warning", "message": {"text": "Vulnerable dependency setuptools 82.0.1: GHSA-h35f-9h28-mq5c"}, "properties": {"repobilityId": "36330ba4f14508b6", "scanner": "scanner-primary", "fingerprint": "9308cb1e3c0e2c58", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h35f-9h28-mq5c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-670f503f21c3ae38", "level": "warning", "message": {"text": "Vulnerable dependency setuptools 82.0.1: PYSEC-2026-3447"}, "properties": {"repobilityId": "c4aa24902be99332", "scanner": "scanner-primary", "fingerprint": "670f503f21c3ae38", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3447"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-098d1276917805de", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-2fqr-mr3j-6wp8"}, "properties": {"repobilityId": "bab9545e3585fd9a", "scanner": "scanner-primary", "fingerprint": "098d1276917805de", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2fqr-mr3j-6wp8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecdcc56410579a4f", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-4fvr-rgm6-gqmc"}, "properties": {"repobilityId": "bdd78732ac3a7e94", "scanner": "scanner-primary", "fingerprint": "ecdcc56410579a4f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4fvr-rgm6-gqmc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f91dcc4d261e736", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-4m7w-qmgq-4wj5"}, "properties": {"repobilityId": "bf4ebef2790dd331", "scanner": "scanner-primary", "fingerprint": "2f91dcc4d261e736", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4m7w-qmgq-4wj5", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-37f565728c2333ab", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-63hw-fmq6-xxg2"}, "properties": {"repobilityId": "288b1c8267c8b070", "scanner": "scanner-primary", "fingerprint": "37f565728c2333ab", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-63hw-fmq6-xxg2", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81be790a4d3b9a0c", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-9x8q-7h8h-wcw9"}, "properties": {"repobilityId": "81111215eaf105d6", "scanner": "scanner-primary", "fingerprint": "81be790a4d3b9a0c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9x8q-7h8h-wcw9", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a2b293ff21393c6", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-g3cq-j2xw-wf74"}, "properties": {"repobilityId": "400eda32c5668896", "scanner": "scanner-primary", "fingerprint": "5a2b293ff21393c6", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g3cq-j2xw-wf74", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8344b71af369c361", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-hg6j-4rv6-33pg"}, "properties": {"repobilityId": "35411f7c88a627d6", "scanner": "scanner-primary", "fingerprint": "8344b71af369c361", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hg6j-4rv6-33pg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbd1b8de50cf0adf", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-hpj7-wq8m-9hgp"}, "properties": {"repobilityId": "a790db6109ec9486", "scanner": "scanner-primary", "fingerprint": "fbd1b8de50cf0adf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hpj7-wq8m-9hgp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb657a8d750092d4", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-jg22-mg44-37j8"}, "properties": {"repobilityId": "b0b222673a33c299", "scanner": "scanner-primary", "fingerprint": "eb657a8d750092d4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jg22-mg44-37j8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3b1a60e298e525f", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-m6qw-4cw2-hm4m"}, "properties": {"repobilityId": "951217c7e839e3ed", "scanner": "scanner-primary", "fingerprint": "b3b1a60e298e525f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-m6qw-4cw2-hm4m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d981acb375653d28", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: GHSA-xcgm-r5h9-7989"}, "properties": {"repobilityId": "dffdbcbe394135ab", "scanner": "scanner-primary", "fingerprint": "d981acb375653d28", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xcgm-r5h9-7989", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4478a7743d38a91", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2104"}, "properties": {"repobilityId": "c76cad4412f80e98", "scanner": "scanner-primary", "fingerprint": "a4478a7743d38a91", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2104", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f6ffe398a8b33f86", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2105"}, "properties": {"repobilityId": "b94658cc4fc17f0c", "scanner": "scanner-primary", "fingerprint": "f6ffe398a8b33f86", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2105", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2c53ec5aa609511", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2106"}, "properties": {"repobilityId": "d1dbe2c9f891af74", "scanner": "scanner-primary", "fingerprint": "a2c53ec5aa609511", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2106", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6932515b23f6ae29", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2108"}, "properties": {"repobilityId": "bb232b71c58e9bdb", "scanner": "scanner-primary", "fingerprint": "6932515b23f6ae29", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2108", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c495c5084118aed5", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2109"}, "properties": {"repobilityId": "8873bb3a5f8db278", "scanner": "scanner-primary", "fingerprint": "c495c5084118aed5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2109", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-298bf2631a76630c", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2110"}, "properties": {"repobilityId": "9738174236475880", "scanner": "scanner-primary", "fingerprint": "298bf2631a76630c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2110", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6906c6f14cc6c9db", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2111"}, "properties": {"repobilityId": "5204809911aab913", "scanner": "scanner-primary", "fingerprint": "6906c6f14cc6c9db", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2111", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c0049664f3ddc66f", "level": "warning", "message": {"text": "Vulnerable dependency aiohttp 3.13.5: PYSEC-2026-2113"}, "properties": {"repobilityId": "02799b26ab42601b", "scanner": "scanner-primary", "fingerprint": "c0049664f3ddc66f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2113", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c6061ea09adbdd50", "level": "warning", "message": {"text": "Vulnerable dependency anthropic 0.86.0: GHSA-q5f5-3gjm-7mfm"}, "properties": {"repobilityId": "47da43d776f9f561", "scanner": "scanner-primary", "fingerprint": "c6061ea09adbdd50", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q5f5-3gjm-7mfm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-205d6720c29ffa77", "level": "warning", "message": {"text": "Vulnerable dependency anthropic 0.86.0: GHSA-w828-4qhx-vxx3"}, "properties": {"repobilityId": "7f5fe1a5f9b8df47", "scanner": "scanner-primary", "fingerprint": "205d6720c29ffa77", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w828-4qhx-vxx3", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f51a5f7005214de", "level": "warning", "message": {"text": "Vulnerable dependency anthropic 0.86.0: PYSEC-2026-2114"}, "properties": {"repobilityId": "383f2406f8aee5c1", "scanner": "scanner-primary", "fingerprint": "2f51a5f7005214de", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2114", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67a82f50829b9e0e", "level": "warning", "message": {"text": "Vulnerable dependency anthropic 0.86.0: PYSEC-2026-2115"}, "properties": {"repobilityId": "4f5091c884a357ff", "scanner": "scanner-primary", "fingerprint": "67a82f50829b9e0e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2115", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ff5ee577077b861", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.9: GHSA-f4j7-r4q5-qw2c"}, "properties": {"repobilityId": "86f3ced99fa91d2c", "scanner": "scanner-primary", "fingerprint": "3ff5ee577077b861", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f4j7-r4q5-qw2c", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-871f8acac193f16e", "level": "warning", "message": {"text": "Vulnerable dependency chromadb 1.5.9: PYSEC-2026-311"}, "properties": {"repobilityId": "a036fd7c9d8ca6eb", "scanner": "scanner-primary", "fingerprint": "871f8acac193f16e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-311", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ad35f96d45e1160", "level": "warning", "message": {"text": "Vulnerable dependency click 8.3.1: PYSEC-2026-2132"}, "properties": {"repobilityId": "346057e715e4d8e2", "scanner": "scanner-primary", "fingerprint": "5ad35f96d45e1160", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2132", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ed38466448647c79", "level": "error", "message": {"text": "Vulnerable dependency cryptography 48.0.0: GHSA-537c-gmf6-5ccf"}, "properties": {"repobilityId": "132152c3c7d7414a", "scanner": "scanner-primary", "fingerprint": "ed38466448647c79", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-537c-gmf6-5ccf", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a02b1a6c81613bd0", "level": "warning", "message": {"text": "Vulnerable dependency ecdsa 0.19.1: GHSA-9f5j-8jwj-x28g"}, "properties": {"repobilityId": "26e293feeb8535dd", "scanner": "scanner-primary", "fingerprint": "a02b1a6c81613bd0", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9f5j-8jwj-x28g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b48e4f3827a43f16", "level": "warning", "message": {"text": "Vulnerable dependency ecdsa 0.19.1: GHSA-wj6h-64fc-37mp"}, "properties": {"repobilityId": "76d5073459c98116", "scanner": "scanner-primary", "fingerprint": "b48e4f3827a43f16", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wj6h-64fc-37mp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a2c68cd1310a8ac", "level": "warning", "message": {"text": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-1325"}, "properties": {"repobilityId": "1f58a4102bf62353", "scanner": "scanner-primary", "fingerprint": "2a2c68cd1310a8ac", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1325", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7115ef0b6e73f1a", "level": "warning", "message": {"text": "Vulnerable dependency ecdsa 0.19.1: PYSEC-2026-2467"}, "properties": {"repobilityId": "350d37c3173198b5", "scanner": "scanner-primary", "fingerprint": "d7115ef0b6e73f1a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2467", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fe17a667e654d9a8", "level": "warning", "message": {"text": "Vulnerable dependency httplib2 0.31.2: PYSEC-2026-3444"}, "properties": {"repobilityId": "aed71e6dba5781c3", "scanner": "scanner-primary", "fingerprint": "fe17a667e654d9a8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3444", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9eb78ac091ef83de", "level": "warning", "message": {"text": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx"}, "properties": {"repobilityId": "fb9a242b2a48123b", "scanner": "scanner-primary", "fingerprint": "9eb78ac091ef83de", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-65pc-fj4g-8rjx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-590d9f87a8f870cb", "level": "warning", "message": {"text": "Vulnerable dependency idna 3.11: PYSEC-2026-215"}, "properties": {"repobilityId": "b8ede6cf01a2d587", "scanner": "scanner-primary", "fingerprint": "590d9f87a8f870cb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-215", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b13f0be57598a48a", "level": "warning", "message": {"text": "Vulnerable dependency langchain 1.2.10: GHSA-gr75-jv2w-4656"}, "properties": {"repobilityId": "9045102db478e032", "scanner": "scanner-primary", "fingerprint": "b13f0be57598a48a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-gr75-jv2w-4656", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e043e7b2d04baf68", "level": "warning", "message": {"text": "Vulnerable dependency langchain 1.2.10: PYSEC-2026-2192"}, "properties": {"repobilityId": "7906d379c9bc1565", "scanner": "scanner-primary", "fingerprint": "e043e7b2d04baf68", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2192", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e8c35f87a0a2cc4", "level": "warning", "message": {"text": "Vulnerable dependency langgraph-checkpoint 4.0.1: GHSA-fjqc-hq36-qh5p"}, "properties": {"repobilityId": "a7d8fc0dc6e2a941", "scanner": "scanner-primary", "fingerprint": "2e8c35f87a0a2cc4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fjqc-hq36-qh5p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4226853a400f74ab", "level": "warning", "message": {"text": "Vulnerable dependency langgraph-checkpoint 4.0.1: PYSEC-2026-2573"}, "properties": {"repobilityId": "2ecfc6f9bfb494fd", "scanner": "scanner-primary", "fingerprint": "4226853a400f74ab", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2573", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b266ce84b0c8ee89", "level": "warning", "message": {"text": "Vulnerable dependency langgraph-sdk 0.3.12: GHSA-w39p-vh2g-g8g5"}, "properties": {"repobilityId": "e9eabbcd0f15a7cd", "scanner": "scanner-primary", "fingerprint": "b266ce84b0c8ee89", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w39p-vh2g-g8g5", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2c7fd466f4809386", "level": "warning", "message": {"text": "Vulnerable dependency langgraph-sdk 0.3.12: PYSEC-2026-2575"}, "properties": {"repobilityId": "e6d4a11d13e404f1", "scanner": "scanner-primary", "fingerprint": "2c7fd466f4809386", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2575", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea4188aa9aac1164", "level": "error", "message": {"text": "Vulnerable dependency langsmith 0.7.22: GHSA-3644-q5cj-c5c7"}, "properties": {"repobilityId": "92b529fa5b72d0bd", "scanner": "scanner-primary", "fingerprint": "ea4188aa9aac1164", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3644-q5cj-c5c7", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e36a135b7acaee6", "level": "warning", "message": {"text": "Vulnerable dependency langsmith 0.7.22: GHSA-f4xh-w4cj-qxq8"}, "properties": {"repobilityId": "da92368484aae14b", "scanner": "scanner-primary", "fingerprint": "7e36a135b7acaee6", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-f4xh-w4cj-qxq8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e8bb21947a3b3cb", "level": "warning", "message": {"text": "Vulnerable dependency langsmith 0.7.22: GHSA-rr7j-v2q5-chgv"}, "properties": {"repobilityId": "a5ab3463f36b5b58", "scanner": "scanner-primary", "fingerprint": "1e8bb21947a3b3cb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rr7j-v2q5-chgv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4266770a0f9b0ed2", "level": "warning", "message": {"text": "Vulnerable dependency langsmith 0.7.22: PYSEC-2026-2583"}, "properties": {"repobilityId": "951a121210828924", "scanner": "scanner-primary", "fingerprint": "4266770a0f9b0ed2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2583", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89b902dc4ed77162", "level": "warning", "message": {"text": "Vulnerable dependency lxml 6.0.2: GHSA-vfmq-68hx-4jfw"}, "properties": {"repobilityId": "683b60e1b81ffebe", "scanner": "scanner-primary", "fingerprint": "89b902dc4ed77162", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vfmq-68hx-4jfw", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e875ca6a80cd961", "level": "warning", "message": {"text": "Vulnerable dependency lxml 6.0.2: PYSEC-2026-87"}, "properties": {"repobilityId": "b8cac1718ed3ecae", "scanner": "scanner-primary", "fingerprint": "5e875ca6a80cd961", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-87", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b62a87c757089d8c", "level": "error", "message": {"text": "Vulnerable dependency mako 1.3.10: GHSA-2h4p-vjrc-8xpq"}, "properties": {"repobilityId": "1f658dc24169754b", "scanner": "scanner-primary", "fingerprint": "b62a87c757089d8c", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2h4p-vjrc-8xpq", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f6d773378806c33f", "level": "warning", "message": {"text": "Vulnerable dependency mako 1.3.10: GHSA-v92g-xgxw-vvmm"}, "properties": {"repobilityId": "91dc1ff4e89696b7", "scanner": "scanner-primary", "fingerprint": "f6d773378806c33f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v92g-xgxw-vvmm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c60b5d7aa243c529", "level": "warning", "message": {"text": "Vulnerable dependency mako 1.3.10: PYSEC-2026-88"}, "properties": {"repobilityId": "d1793c9d424e7de1", "scanner": "scanner-primary", "fingerprint": "c60b5d7aa243c529", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-88", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f00df8a75b13e35", "level": "warning", "message": {"text": "Vulnerable dependency mcp 1.27.2: GHSA-vj7q-gjh5-988w"}, "properties": {"repobilityId": "3a95744ed17180f6", "scanner": "scanner-primary", "fingerprint": "9f00df8a75b13e35", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vj7q-gjh5-988w", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3e39651c40f8829", "level": "warning", "message": {"text": "Vulnerable dependency mcp 1.27.2: PYSEC-2026-3483"}, "properties": {"repobilityId": "c6c75bf02c724809", "scanner": "scanner-primary", "fingerprint": "b3e39651c40f8829", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3483", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a7df66511c32e507", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.4: GHSA-p4gq-832x-fm9v"}, "properties": {"repobilityId": "f3906c61d38b14a4", "scanner": "scanner-primary", "fingerprint": "a7df66511c32e507", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-p4gq-832x-fm9v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89976e44e70ab5eb", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.4: PYSEC-2026-2078"}, "properties": {"repobilityId": "0226189cd3d11459", "scanner": "scanner-primary", "fingerprint": "89976e44e70ab5eb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2078", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-058fb440d8049bc8", "level": "warning", "message": {"text": "Vulnerable dependency nltk 3.9.4: PYSEC-2026-597"}, "properties": {"repobilityId": "3f59a91267d08504", "scanner": "scanner-primary", "fingerprint": "058fb440d8049bc8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-597", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d995751454261a0", "level": "error", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-45hq-cxwh-f6vc"}, "properties": {"repobilityId": "aa3b14739bbef72b", "scanner": "scanner-primary", "fingerprint": "6d995751454261a0", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-45hq-cxwh-f6vc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f4b3942f75c39fb7", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-4x4j-2g7c-83w6"}, "properties": {"repobilityId": "91e8a03e577bae02", "scanner": "scanner-primary", "fingerprint": "f4b3942f75c39fb7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4x4j-2g7c-83w6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80d23e7e5cedc838", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-5x94-69rx-g8h2"}, "properties": {"repobilityId": "2d4c8223e6626769", "scanner": "scanner-primary", "fingerprint": "80d23e7e5cedc838", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5x94-69rx-g8h2", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a709801af7061212", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-62p4-gmf7-7g93"}, "properties": {"repobilityId": "e653fe36805aafaa", "scanner": "scanner-primary", "fingerprint": "a709801af7061212", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-62p4-gmf7-7g93", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d488ecf384acbbd", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-6r8x-57c9-28j4"}, "properties": {"repobilityId": "1b486a2481908eff", "scanner": "scanner-primary", "fingerprint": "2d488ecf384acbbd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6r8x-57c9-28j4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-810121168c8feca0", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-8v84-f9pq-wr9x"}, "properties": {"repobilityId": "ef47e84b0e5ae1e5", "scanner": "scanner-primary", "fingerprint": "810121168c8feca0", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8v84-f9pq-wr9x", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db7095c23c7d9a9a", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-9hw9-ch79-4vh6"}, "properties": {"repobilityId": "37c76b536a5e3ca7", "scanner": "scanner-primary", "fingerprint": "db7095c23c7d9a9a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9hw9-ch79-4vh6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d62ce5d113f61c6", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-fj7v-r99m-22gq"}, "properties": {"repobilityId": "8c5f2bae30f4808b", "scanner": "scanner-primary", "fingerprint": "3d62ce5d113f61c6", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-fj7v-r99m-22gq", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e768ea2475b0abc", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-jjj6-mw9f-p565"}, "properties": {"repobilityId": "8c12a8bae91406e6", "scanner": "scanner-primary", "fingerprint": "6e768ea2475b0abc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jjj6-mw9f-p565", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db12f1b7ea020c90", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-pg7v-jwj7-p798"}, "properties": {"repobilityId": "8a8b9d176a7eab87", "scanner": "scanner-primary", "fingerprint": "db12f1b7ea020c90", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-pg7v-jwj7-p798", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cddec2ecd753bafa", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-phj9-mv4w-65pm"}, "properties": {"repobilityId": "d63a858112ef3b9e", "scanner": "scanner-primary", "fingerprint": "cddec2ecd753bafa", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-phj9-mv4w-65pm", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26640ec69704fbfc", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-vjc4-5qp5-m44j"}, "properties": {"repobilityId": "688ba43d96b2dd12", "scanner": "scanner-primary", "fingerprint": "26640ec69704fbfc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vjc4-5qp5-m44j", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-03da68e3c28d61c9", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: GHSA-xj96-63gp-2gmr"}, "properties": {"repobilityId": "679c10bad6992102", "scanner": "scanner-primary", "fingerprint": "03da68e3c28d61c9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-xj96-63gp-2gmr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf8c69fc45f30405", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2253"}, "properties": {"repobilityId": "891c3462b41343de", "scanner": "scanner-primary", "fingerprint": "cf8c69fc45f30405", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2253", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8627d30958e9fbe8", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2254"}, "properties": {"repobilityId": "7241fed9159a329f", "scanner": "scanner-primary", "fingerprint": "8627d30958e9fbe8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2254", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bcacfbc7fc56fda4", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-2256"}, "properties": {"repobilityId": "405c39729d33471e", "scanner": "scanner-primary", "fingerprint": "bcacfbc7fc56fda4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2256", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-215db17939c2ee31", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3451"}, "properties": {"repobilityId": "5b67c7a9904cbe1c", "scanner": "scanner-primary", "fingerprint": "215db17939c2ee31", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3451", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5356a1862c74b797", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3452"}, "properties": {"repobilityId": "acdbadc9bebb3b65", "scanner": "scanner-primary", "fingerprint": "5356a1862c74b797", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3452", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-50b1bb0ae9c15861", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3453"}, "properties": {"repobilityId": "f72507b3412cd61f", "scanner": "scanner-primary", "fingerprint": "50b1bb0ae9c15861", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3453", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-663897b47c6ca904", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3454"}, "properties": {"repobilityId": "fd76508ac4181e95", "scanner": "scanner-primary", "fingerprint": "663897b47c6ca904", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3454", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9194377f7177c09c", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3493"}, "properties": {"repobilityId": "45d81e171a4d5c15", "scanner": "scanner-primary", "fingerprint": "9194377f7177c09c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3493", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-85e936c145f21b1e", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3494"}, "properties": {"repobilityId": "c6d9c611a8cbcab2", "scanner": "scanner-primary", "fingerprint": "85e936c145f21b1e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3494", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eaa2eaec8b31db52", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3495"}, "properties": {"repobilityId": "380af25374980d21", "scanner": "scanner-primary", "fingerprint": "eaa2eaec8b31db52", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3495", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aabac34917dd57fc", "level": "warning", "message": {"text": "Vulnerable dependency pillow 12.2.0: PYSEC-2026-3496"}, "properties": {"repobilityId": "2872a86f1c3df355", "scanner": "scanner-primary", "fingerprint": "aabac34917dd57fc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3496", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-31e278ed2d614d1d", "level": "warning", "message": {"text": "Vulnerable dependency pyarrow 20.0.0: GHSA-rgxp-2hwp-jwgg"}, "properties": {"repobilityId": "87ba31e3b7bb8b29", "scanner": "scanner-primary", "fingerprint": "31e278ed2d614d1d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgxp-2hwp-jwgg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac7eab59ee4f3ae2", "level": "warning", "message": {"text": "Vulnerable dependency pyarrow 20.0.0: PYSEC-2026-113"}, "properties": {"repobilityId": "e926c2a8f157b363", "scanner": "scanner-primary", "fingerprint": "ac7eab59ee4f3ae2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-113", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4be8be837d3218a8", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.3: GHSA-8ppf-4f7h-5ppj"}, "properties": {"repobilityId": "35f07a3a79393e33", "scanner": "scanner-primary", "fingerprint": "4be8be837d3218a8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8ppf-4f7h-5ppj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a40b871965f1506", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.3: GHSA-hm4w-wwcw-mr6r"}, "properties": {"repobilityId": "dadec8e86f1cd2fe", "scanner": "scanner-primary", "fingerprint": "2a40b871965f1506", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hm4w-wwcw-mr6r", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f8b7f5ba4fa43ada", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3455"}, "properties": {"repobilityId": "2d11f7392b5f7352", "scanner": "scanner-primary", "fingerprint": "f8b7f5ba4fa43ada", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3455", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8c025f6c1aee6ca0", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3456"}, "properties": {"repobilityId": "c3522bbb62e44c0f", "scanner": "scanner-primary", "fingerprint": "8c025f6c1aee6ca0", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3456", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9bbf32ae7157c304", "level": "warning", "message": {"text": "Vulnerable dependency pyasn1 0.6.3: PYSEC-2026-3457"}, "properties": {"repobilityId": "b83fefaaea70e314", "scanner": "scanner-primary", "fingerprint": "9bbf32ae7157c304", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3457", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-561199607badef54", "level": "warning", "message": {"text": "Vulnerable dependency pydantic-settings 2.13.1: GHSA-4xgf-cpjx-pc3j"}, "properties": {"repobilityId": "c06b11fbfae6fa12", "scanner": "scanner-primary", "fingerprint": "561199607badef54", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4xgf-cpjx-pc3j", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f35e24090839556", "level": "warning", "message": {"text": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq"}, "properties": {"repobilityId": "b5634ffa34a95a85", "scanner": "scanner-primary", "fingerprint": "2f35e24090839556", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5239-wwwm-4pmq", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a50fa2ce80b32a71", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-248m-82v9-q6g6"}, "properties": {"repobilityId": "3e187e0d8b38b508", "scanner": "scanner-primary", "fingerprint": "a50fa2ce80b32a71", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-248m-82v9-q6g6", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-972c63d8adbfabd0", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-3crg-w4f6-42mx"}, "properties": {"repobilityId": "c473e0b1c93f653c", "scanner": "scanner-primary", "fingerprint": "972c63d8adbfabd0", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3crg-w4f6-42mx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b794b8fb2cd0df07", "level": "error", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-4pxv-j86v-mhcw"}, "properties": {"repobilityId": "12ab09e0de3d9b0f", "scanner": "scanner-primary", "fingerprint": "b794b8fb2cd0df07", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4pxv-j86v-mhcw", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ecfa2d5ab179a94", "level": "error", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-52x6-gq3r-vpf4"}, "properties": {"repobilityId": "c1a47c0daa2719a6", "scanner": "scanner-primary", "fingerprint": "7ecfa2d5ab179a94", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-52x6-gq3r-vpf4", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f5f42ed9ae66c574", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-55h5-xmcq-c37v"}, "properties": {"repobilityId": "03192aaef8b7973c", "scanner": "scanner-primary", "fingerprint": "f5f42ed9ae66c574", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-55h5-xmcq-c37v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a1ab466da83d833", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-5hgr-hg42-57jg"}, "properties": {"repobilityId": "e580d19ee787502c", "scanner": "scanner-primary", "fingerprint": "7a1ab466da83d833", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5hgr-hg42-57jg", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aaf485df2db62d5d", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-5qjq-93h5-hrgp"}, "properties": {"repobilityId": "2bf5d8fe36a73c76", "scanner": "scanner-primary", "fingerprint": "aaf485df2db62d5d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5qjq-93h5-hrgp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67188bf8db1a6acc", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-5xf7-4p34-54qr"}, "properties": {"repobilityId": "d7e5dd3ea27a1009", "scanner": "scanner-primary", "fingerprint": "67188bf8db1a6acc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5xf7-4p34-54qr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8bea12871e78cb11", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-7gw9-cf7v-778f"}, "properties": {"repobilityId": "b2356488613a0954", "scanner": "scanner-primary", "fingerprint": "8bea12871e78cb11", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-7gw9-cf7v-778f", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1984bb44e901eec", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-87mj-5ggw-8qc3"}, "properties": {"repobilityId": "a829352a984cb3d3", "scanner": "scanner-primary", "fingerprint": "d1984bb44e901eec", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-87mj-5ggw-8qc3", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36b109996dde2ae4", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-cj93-chg6-vgv8"}, "properties": {"repobilityId": "945959c49b1079e4", "scanner": "scanner-primary", "fingerprint": "36b109996dde2ae4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-cj93-chg6-vgv8", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf1f8d563bbf087d", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-g867-7843-wf8q"}, "properties": {"repobilityId": "00c875691fa6146e", "scanner": "scanner-primary", "fingerprint": "cf1f8d563bbf087d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g867-7843-wf8q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a6fa9b38ef4c08f5", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-g9xf-7f8q-9mcj"}, "properties": {"repobilityId": "a66959d4d3b26403", "scanner": "scanner-primary", "fingerprint": "a6fa9b38ef4c08f5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g9xf-7f8q-9mcj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e522ea9747056641", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-hqmh-ppp3-xvm7"}, "properties": {"repobilityId": "2cad4d926779cba6", "scanner": "scanner-primary", "fingerprint": "e522ea9747056641", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hqmh-ppp3-xvm7", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4cc1ddb65be1888f", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-j543-4vmf-qm7v"}, "properties": {"repobilityId": "bdc007bf046c7cc5", "scanner": "scanner-primary", "fingerprint": "4cc1ddb65be1888f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j543-4vmf-qm7v", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ff8568c31bf7ffbf", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-jj6c-8h6c-hppx"}, "properties": {"repobilityId": "3df15116a66be43b", "scanner": "scanner-primary", "fingerprint": "ff8568c31bf7ffbf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jj6c-8h6c-hppx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-239a28dd9d1ff3bf", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-jm82-fx9c-mx94"}, "properties": {"repobilityId": "bfdff6312f68ddf6", "scanner": "scanner-primary", "fingerprint": "239a28dd9d1ff3bf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jm82-fx9c-mx94", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae3f64a47cac38eb", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-m2v9-299j-rv96"}, "properties": {"repobilityId": "59dae3316d38497d", "scanner": "scanner-primary", "fingerprint": "ae3f64a47cac38eb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-m2v9-299j-rv96", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7f76ae3d41383154", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-qpxp-75px-xjcp"}, "properties": {"repobilityId": "8cf2e5f06d641e0d", "scanner": "scanner-primary", "fingerprint": "7f76ae3d41383154", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qpxp-75px-xjcp", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26fce7a084669302", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-wjqc-6w8f-h24c"}, "properties": {"repobilityId": "3e37a9d7b539e1b6", "scanner": "scanner-primary", "fingerprint": "26fce7a084669302", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wjqc-6w8f-h24c", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-48500fdf573a66a8", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: GHSA-x284-j5p8-9c5p"}, "properties": {"repobilityId": "5bf0f5b405e39eec", "scanner": "scanner-primary", "fingerprint": "48500fdf573a66a8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-x284-j5p8-9c5p", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2546f1df26cb592", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3011"}, "properties": {"repobilityId": "10f1ec6822a3c18d", "scanner": "scanner-primary", "fingerprint": "e2546f1df26cb592", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3011", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-22f0d52345f942bb", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3012"}, "properties": {"repobilityId": "d6a8c945882935d0", "scanner": "scanner-primary", "fingerprint": "22f0d52345f942bb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3012", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4da3e67ad6095504", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3016"}, "properties": {"repobilityId": "fb6646458634bc67", "scanner": "scanner-primary", "fingerprint": "4da3e67ad6095504", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3016", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-148ff56e75d2ddb9", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3018"}, "properties": {"repobilityId": "727d63585c194c9c", "scanner": "scanner-primary", "fingerprint": "148ff56e75d2ddb9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3018", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-57461f2624707fae", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3019"}, "properties": {"repobilityId": "e95c2f9ae61a584d", "scanner": "scanner-primary", "fingerprint": "57461f2624707fae", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3019", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f32720b2a6961bcf", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3020"}, "properties": {"repobilityId": "9a6cda9895a6bba6", "scanner": "scanner-primary", "fingerprint": "f32720b2a6961bcf", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3020", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27ddc14ba2be39e9", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3021"}, "properties": {"repobilityId": "bebd437fd6904cf8", "scanner": "scanner-primary", "fingerprint": "27ddc14ba2be39e9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3021", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6129d28c76b4a6a4", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3022"}, "properties": {"repobilityId": "d8493772f7d2cab2", "scanner": "scanner-primary", "fingerprint": "6129d28c76b4a6a4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3022", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83bf467f52c1c5c2", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3023"}, "properties": {"repobilityId": "523b181c3e8c97f6", "scanner": "scanner-primary", "fingerprint": "83bf467f52c1c5c2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3023", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1372d1dcd98cf2be", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3025"}, "properties": {"repobilityId": "71d3c92ebce1d09a", "scanner": "scanner-primary", "fingerprint": "1372d1dcd98cf2be", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3025", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a4d6aee06a6af639", "level": "warning", "message": {"text": "Vulnerable dependency pypdf 6.7.5: PYSEC-2026-3026"}, "properties": {"repobilityId": "83d89bf531a1f859", "scanner": "scanner-primary", "fingerprint": "a4d6aee06a6af639", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3026", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a7600b42a45c10b", "level": "error", "message": {"text": "Vulnerable dependency python-multipart 0.0.27: GHSA-5rvq-cxj2-64vf"}, "properties": {"repobilityId": "88fe0a994b916dae", "scanner": "scanner-primary", "fingerprint": "9a7600b42a45c10b", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5rvq-cxj2-64vf", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-657b7bde6424083a", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.27: GHSA-6jv3-5f52-599m"}, "properties": {"repobilityId": "8692bd05921058bb", "scanner": "scanner-primary", "fingerprint": "657b7bde6424083a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6jv3-5f52-599m", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7e40b84f6d4e5095", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.27: GHSA-v9pg-7xvm-68hf"}, "properties": {"repobilityId": "07f883f4146affbd", "scanner": "scanner-primary", "fingerprint": "7e40b84f6d4e5095", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-v9pg-7xvm-68hf", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-588c009acf404c7e", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.27: GHSA-vffw-93wf-4j4q"}, "properties": {"repobilityId": "93525948c860f99b", "scanner": "scanner-primary", "fingerprint": "588c009acf404c7e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vffw-93wf-4j4q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11d4be7e61291b45", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3037"}, "properties": {"repobilityId": "b2d2a5e2e5f8ae4b", "scanner": "scanner-primary", "fingerprint": "11d4be7e61291b45", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3037", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea20bcf5ec3ba094", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3040"}, "properties": {"repobilityId": "515b21a1ee827c32", "scanner": "scanner-primary", "fingerprint": "ea20bcf5ec3ba094", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3040", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-febc604f7c574e01", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.27: PYSEC-2026-3041"}, "properties": {"repobilityId": "cfa9d05cf8efb0b0", "scanner": "scanner-primary", "fingerprint": "febc604f7c574e01", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3041", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6e99059f40540132", "level": "error", "message": {"text": "Vulnerable dependency soupsieve 2.8.3: GHSA-2wc2-fm75-p42x"}, "properties": {"repobilityId": "6b266b63f845b75a", "scanner": "scanner-primary", "fingerprint": "6e99059f40540132", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2wc2-fm75-p42x", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f34ac0e4985e7ee4", "level": "warning", "message": {"text": "Vulnerable dependency soupsieve 2.8.3: GHSA-836r-79rf-4m37"}, "properties": {"repobilityId": "87f14fd915a59f85", "scanner": "scanner-primary", "fingerprint": "f34ac0e4985e7ee4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-836r-79rf-4m37", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d4fcbf73dcac901f", "level": "warning", "message": {"text": "Vulnerable dependency soupsieve 2.8.3: PYSEC-2026-3072"}, "properties": {"repobilityId": "3a43a0b052739a60", "scanner": "scanner-primary", "fingerprint": "d4fcbf73dcac901f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3072", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2c8013eb5eaff91", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-82w8-qh3p-5jfq"}, "properties": {"repobilityId": "b251d93440cbabf3", "scanner": "scanner-primary", "fingerprint": "f2c8013eb5eaff91", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-82w8-qh3p-5jfq", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c15b30fde69ed75", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-86qp-5c8j-p5mr"}, "properties": {"repobilityId": "bfe8ab9063c6084a", "scanner": "scanner-primary", "fingerprint": "5c15b30fde69ed75", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-86qp-5c8j-p5mr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68d456f086a60172", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-jp82-jpqv-5vv3"}, "properties": {"repobilityId": "67a5509c81c86f46", "scanner": "scanner-primary", "fingerprint": "68d456f086a60172", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jp82-jpqv-5vv3", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc8f5ac9a4f33f8f", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-wqp7-x3pw-xc5r"}, "properties": {"repobilityId": "07cd6a5b2e071130", "scanner": "scanner-primary", "fingerprint": "fc8f5ac9a4f33f8f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wqp7-x3pw-xc5r", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7da100bb44b705f7", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: GHSA-x746-7m8f-x49c"}, "properties": {"repobilityId": "b734eb1689015a3c", "scanner": "scanner-primary", "fingerprint": "7da100bb44b705f7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-x746-7m8f-x49c", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d045151a0b52dfbd", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-161"}, "properties": {"repobilityId": "a07c0c07cc0cf598", "scanner": "scanner-primary", "fingerprint": "d045151a0b52dfbd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-161", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db597718539d655b", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-2280"}, "properties": {"repobilityId": "1942c6f60e92bc32", "scanner": "scanner-primary", "fingerprint": "db597718539d655b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2280", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-526a1dd33e27d6f5", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-2281"}, "properties": {"repobilityId": "6e311b680f1aaba6", "scanner": "scanner-primary", "fingerprint": "526a1dd33e27d6f5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2281", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28608c156a1a234a", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-248"}, "properties": {"repobilityId": "c4e67d11d07156d9", "scanner": "scanner-primary", "fingerprint": "28608c156a1a234a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-248", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ce24ff16c98d6d5", "level": "warning", "message": {"text": "Vulnerable dependency starlette 0.52.1: PYSEC-2026-249"}, "properties": {"repobilityId": "a36296b0e1a0a7f9", "scanner": "scanner-primary", "fingerprint": "8ce24ff16c98d6d5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-249", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-598c14bfc13989e2", "level": "warning", "message": {"text": "Vulnerable dependency torch 2.10.0: GHSA-rrmf-rvhw-rf47"}, "properties": {"repobilityId": "1b41ff09403ad19f", "scanner": "scanner-primary", "fingerprint": "598c14bfc13989e2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rrmf-rvhw-rf47", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd035c134e2bfaa7", "level": "warning", "message": {"text": "Vulnerable dependency torch 2.10.0: PYSEC-2026-139"}, "properties": {"repobilityId": "e55966d65ee3fc97", "scanner": "scanner-primary", "fingerprint": "cd035c134e2bfaa7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-139", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47cc8878f0379db8", "level": "warning", "message": {"text": "Vulnerable dependency urllib3 2.6.3: GHSA-mf9v-mfxr-j63j"}, "properties": {"repobilityId": "58bf68e0b735c3e5", "scanner": "scanner-primary", "fingerprint": "47cc8878f0379db8", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mf9v-mfxr-j63j", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-433f57b90f387132", "level": "warning", "message": {"text": "Vulnerable dependency urllib3 2.6.3: GHSA-qccp-gfcp-xxvc"}, "properties": {"repobilityId": "85d3ff0504c74b92", "scanner": "scanner-primary", "fingerprint": "433f57b90f387132", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qccp-gfcp-xxvc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a7d4ee40fdfda62", "level": "warning", "message": {"text": "Vulnerable dependency urllib3 2.6.3: PYSEC-2026-141"}, "properties": {"repobilityId": "701c2015b9d154c2", "scanner": "scanner-primary", "fingerprint": "9a7d4ee40fdfda62", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-141", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b0cc2808acdb73ab", "level": "warning", "message": {"text": "Vulnerable dependency urllib3 2.6.3: PYSEC-2026-142"}, "properties": {"repobilityId": "49390d2c616581f1", "scanner": "scanner-primary", "fingerprint": "b0cc2808acdb73ab", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "PYSEC-2026-142", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "uv.lock"}, "region": {"startLine": 1}}}]}]}]}