{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8e449dbf3be7ee68", "name": "Possibly dead Python function: grain", "shortDescription": {"text": "Possibly dead Python function: grain"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c628d1d3307eeca0", "name": "Possibly dead Python function: date_part", "shortDescription": {"text": "Possibly dead Python function: date_part"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a1488c591c93a37", "name": "Possibly dead Python function: descending", "shortDescription": {"text": "Possibly dead Python function: descending"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbe2ad8f341a982d", "name": "Possibly dead Python function: is_omni_name", "shortDescription": {"text": "Possibly dead Python function: is_omni_name"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-370e07f66ad78984", "name": "Possibly dead Python function: repl", "shortDescription": {"text": "Possibly dead Python function: repl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b31f679f3f76b3c", "name": "Possibly dead Python function: replace_ref", "shortDescription": {"text": "Possibly dead Python function: replace_ref"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a93d41e4c1c7300b", "name": "Possibly dead Python function: repl", "shortDescription": {"text": "Possibly dead Python function: repl"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-151180723a85e514", "name": "CVE-2026-10532: ch.qos.logback:logback-core 1.5.25 \u2014 converters/salesforce/pom.xml", "shortDescription": {"text": "CVE-2026-10532: ch.qos.logback:logback-core 1.5.25 \u2014 converters/salesforce/pom.xml"}, "fullDescription": {"text": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...\n\nDeserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection, albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate Proxy objects.\n\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \npractical way to achieve remote code execution or significant privilege \nescalat\n\nPackage: ch.qos.logback:logback-core\nInstalled: 1.5.25\nFixed in: 1.5.34\nSeverity: LOW\nFix: Upgrade ch.qos.logback:logback-core to 1.5.34"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d77edc8ceec6eebb", "name": "CVE-2026-9828: ch.qos.logback:logback-core 1.5.25 \u2014 converters/salesforce/pom.xml", "shortDescription": {"text": "CVE-2026-9828: ch.qos.logback:logback-core 1.5.25 \u2014 converters/salesforce/pom.xml"}, "fullDescription": {"text": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...\n\nDeserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allows Object Injection albeit heavily restricted.\n\nMore precisely, an attacker able to influence serialized data sent to \nSimpleSocketServer or SimpleSSLSocketServer can instantiate objects from\n classes in the java.lang and java.util packages that are not explicitly\n blocked.\n\nAlthough deserialization is heavily restricted by HardenedObjectInputStream and no \np\n\nPackage: ch.qos.logback:logback-core\nInstalled: 1.5.25\nFixed in: 1.5.33\nSeverity: LOW\nFix: Upgrade ch.qos.logback:logback-core to 1.5.33"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-244b817fe7c943c8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a3014fe20e05aa0", "name": "Very large file: converters/honeydew/tests/test_honeydew_osi_converter.py (1496 lines)", "shortDescription": {"text": "Very large file: converters/honeydew/tests/test_honeydew_osi_converter.py (1496 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd161f7b6f3ce686", "name": "Very large file: converters/orionbelt/src/ossie_orionbelt/osi_to_obml.py (1277 lines)", "shortDescription": {"text": "Very large file: converters/orionbelt/src/ossie_orionbelt/osi_to_obml.py (1277 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 52 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52cc2b7539f93ded", "name": "Legacy-named symbol `model_copy` in converters/wisdom/src/ossie_wisdom/wisdom_to_osi.py:242", "shortDescription": {"text": "Legacy-named symbol `model_copy` in converters/wisdom/src/ossie_wisdom/wisdom_to_osi.py:242"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same substantial AST body hash:\nconverters/databricks/src/ossie_databricks/_common.py:79:require, converters/omni/src/osi_omni/_common.py:81:require\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30769"}, "properties": {"repository": "apache/ossie", "repoUrl": "https://github.com/apache/ossie", "branch": "main"}, "results": [{"ruleId": "scanner-8e449dbf3be7ee68", "level": "note", "message": {"text": "Possibly dead Python function: grain"}, "properties": {"repobilityId": "a10925f14a3c5999", "scanner": "scanner-primary", "fingerprint": "8e449dbf3be7ee68", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "converters/dbt/src/ossie_dbt/filter_utils.py:67"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c628d1d3307eeca0", "level": "note", "message": {"text": "Possibly dead Python function: date_part"}, "properties": {"repobilityId": "d31f9d9eeece3e84", "scanner": "scanner-primary", "fingerprint": "c628d1d3307eeca0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "converters/dbt/src/ossie_dbt/filter_utils.py:71"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a1488c591c93a37", "level": "note", "message": {"text": "Possibly dead Python function: descending"}, "properties": {"repobilityId": "fe9b35c9bb555536", "scanner": "scanner-primary", "fingerprint": "8a1488c591c93a37", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "converters/dbt/src/ossie_dbt/filter_utils.py:103"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbe2ad8f341a982d", "level": "note", "message": {"text": "Possibly dead Python function: is_omni_name"}, "properties": {"repobilityId": "b0daa105dc39205e", "scanner": "scanner-primary", "fingerprint": "dbe2ad8f341a982d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "converters/omni/src/osi_omni/_common.py:169"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-370e07f66ad78984", "level": "note", "message": {"text": "Possibly dead Python function: repl"}, "properties": {"repobilityId": "6f5d3779bbb8be8b", "scanner": "scanner-primary", "fingerprint": "370e07f66ad78984", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "converters/omni/src/osi_omni/_common.py:386"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b31f679f3f76b3c", "level": "note", "message": {"text": "Possibly dead Python function: replace_ref"}, "properties": {"repobilityId": "e03f1cb71b060876", "scanner": "scanner-primary", "fingerprint": "7b31f679f3f76b3c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "converters/orionbelt/src/ossie_orionbelt/obml_to_osi.py:732"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a93d41e4c1c7300b", "level": "note", "message": {"text": "Possibly dead Python function: repl"}, "properties": {"repobilityId": "6f5d3779bbb8be8b", "scanner": "scanner-primary", "fingerprint": "a93d41e4c1c7300b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "converters/orionbelt/src/ossie_orionbelt/osi_to_obml.py:1075"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-151180723a85e514", "level": "note", "message": {"text": "CVE-2026-10532: ch.qos.logback:logback-core 1.5.25 \u2014 converters/salesforce/pom.xml"}, "properties": {"repobilityId": "0e0d4d4f8e46906a", "scanner": "scanner-primary", "fingerprint": "151180723a85e514", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-10532"]}}, {"ruleId": "scanner-d77edc8ceec6eebb", "level": "note", "message": {"text": "CVE-2026-9828: ch.qos.logback:logback-core 1.5.25 \u2014 converters/salesforce/pom.xml"}, "properties": {"repobilityId": "042a843ff8c84dd0", "scanner": "scanner-primary", "fingerprint": "d77edc8ceec6eebb", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-9828"]}}, {"ruleId": "scanner-244b817fe7c943c8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ff3fd4a977a2f449", "scanner": "scanner-primary", "fingerprint": "244b817fe7c943c8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/cli-ci.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-2a3014fe20e05aa0", "level": "note", "message": {"text": "Very large file: converters/honeydew/tests/test_honeydew_osi_converter.py (1496 lines)"}, "properties": {"repobilityId": "60938094b2989491", "scanner": "scanner-primary", "fingerprint": "2a3014fe20e05aa0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fd161f7b6f3ce686", "level": "note", "message": {"text": "Very large file: converters/orionbelt/src/ossie_orionbelt/osi_to_obml.py (1277 lines)"}, "properties": {"repobilityId": "a491213fed7ce0a3", "scanner": "scanner-primary", "fingerprint": "fd161f7b6f3ce686", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "932db86a992c8b72", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-52cc2b7539f93ded", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in converters/wisdom/src/ossie_wisdom/wisdom_to_osi.py:242"}, "properties": {"repobilityId": "dfebed37f50770ae", "scanner": "scanner-primary", "fingerprint": "52cc2b7539f93ded", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "35a380de5e702dd1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}