{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-768220b0f4502d10", "name": "Stray `console.log` in TS/JS \u2014 playground/runtime-node-module/index.js:4", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 playground/runtime-node-module/index.js:4"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cecde52f8c0013d4", "name": "Stray `console.log` in TS/JS \u2014 playground/multi-exports-commonjs/src/cli.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 playground/multi-exports-commonjs/src/cli.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3dc537216aec273b", "name": "Stray `console.log` in TS/JS \u2014 playground/runtime-node-commonjs/index.js:4", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 playground/runtime-node-commonjs/index.js:4"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08a9f427869228fb", "name": "Stray `console.log` in TS/JS \u2014 playground/dummy-side-effects/side-effect.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 playground/dummy-side-effects/side-effect.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b8b0db755b2ec3a", "name": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/spinner.ts:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/spinner.ts:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65e26b054c06697c", "name": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/build.ts:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/build.ts:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-837e88ebcd972149", "name": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/logger.ts:17", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/logger.ts:17"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b5139f431d5b266", "name": "Stray `console.log` in TS/JS \u2014 packages/@sanity/tsdown-config/test/fixtures/react-19-library/src/Button.tsx:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/@sanity/tsdown-config/test/fixtures/react-19-library/src/Button.tsx:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f388fd6bfe8ce531", "name": "Insecure pattern 'direct_innerhtml_assignment' in playground/runtime-vite/src/main.ts:7", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in playground/runtime-vite/src/main.ts:7"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1cf3c54f2ee7c999", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "sanity-io/.github/.github/workflows/format.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0337ea5f616c60ca", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "sanity-io/.github/.github/workflows/changesets-from-conventional-commits.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2dd8b4c4ff10305", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "sanity-io/.github/.github/workflows/changesets.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "32 tests / 239 src (ratio 0.13)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50e712dbde9ed7f0", "name": "Node manifest has dependencies but no lockfile: playground/dummy-lodash-es/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/dummy-lodash-es/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-327dcac738c8f42c", "name": "Node manifest has dependencies but no lockfile: playground/dummy-lodash/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/dummy-lodash/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-036640edd00b0af1", "name": "Node manifest has dependencies but no lockfile: playground/runtime-vite/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-vite/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32ee1aa391af8263", "name": "Node manifest has dependencies but no lockfile: playground/tsgo/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/tsgo/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5349760c90d50f8b", "name": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-peer-dependency/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-peer-dependency/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9d78057b8acdc21", "name": "Node manifest has dependencies but no lockfile: playground/runtime-astro/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-astro/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-746cf2205b365359", "name": "Node manifest has dependencies but no lockfile: playground/runtime-node-module/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-node-module/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a32f3eae3170d21b", "name": "Node manifest has dependencies but no lockfile: playground/sanity-plugin-with-vanilla-extract/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/sanity-plugin-with-vanilla-extract/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e15219017f4fa2a5", "name": "Node manifest has dependencies but no lockfile: playground/tsgo-disabled/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/tsgo-disabled/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7d658a50eec48d2", "name": "Node manifest has dependencies but no lockfile: playground/babel-plugin/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/babel-plugin/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78172e1c7fa12a75", "name": "Node manifest has dependencies but no lockfile: playground/use-client-directive/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/use-client-directive/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d82e1b419b6fd854", "name": "Node manifest has dependencies but no lockfile: playground/reference-cjs/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/reference-cjs/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e689febeb8d0fe1", "name": "Node manifest has dependencies but no lockfile: playground/runtime-next-js/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-next-js/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-130c087062ab71b2", "name": "Node manifest has dependencies but no lockfile: playground/reference-esm/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/reference-esm/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f6252a0601c91d0", "name": "Node manifest has dependencies but no lockfile: playground/multi-export/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/multi-export/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e22f6b77512ace8d", "name": "Node manifest has dependencies but no lockfile: playground/react-19/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/react-19/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-312160e2431967d3", "name": "Node manifest has dependencies but no lockfile: playground/sanity-plugin-with-styled-components/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/sanity-plugin-with-styled-components/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cd5feb391fd794b", "name": "Node manifest has dependencies but no lockfile: playground/reference-esm-only/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/reference-esm-only/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-affe6f166ff2ac22", "name": "Node manifest has dependencies but no lockfile: playground/react-18/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/react-18/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66ac04c1fc060bdb", "name": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-prod-dependency/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-prod-dependency/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edd80643af7a27e7", "name": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-dev-dependency/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-dev-dependency/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04d3fe497c607728", "name": "Node manifest has dependencies but no lockfile: playground/strict-legacy-fields/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/strict-legacy-fields/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e02367a9d7cb1eb7", "name": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-external-subpath-import/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-external-subpath-import/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1057be62a9135c8", "name": "Node manifest has dependencies but no lockfile: playground/runtime-node-commonjs/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-node-commonjs/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc3defaa7f8e4ca9", "name": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-inline-types-external-js/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-inline-types-external-js/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f99c77287868d18", "name": "Node manifest has dependencies but no lockfile: packages/@sanity/pkg-utils/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/@sanity/pkg-utils/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29c34b7446de4478", "name": "Node manifest has dependencies but no lockfile: packages/@sanity/parse-package-json/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/@sanity/parse-package-json/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18836b9dd62314a9", "name": "Node manifest has dependencies but no lockfile: packages/@sanity/tsdown-config/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/@sanity/tsdown-config/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1941197d43a762d", "name": "Node manifest has dependencies but no lockfile: packages/@sanity/tsdown-config/test/fixtures/react-19-library/package.js", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/@sanity/tsdown-config/test/fixtures/react-19-library/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 23 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 27 placeholder/mock markers across 19 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6a8b2c4dacd7c473", "name": "Commented-code block (5 lines) in packages/@sanity/pkg-utils/src/node/tasks/rolldown/resolveRolldownConfig.ts:163", "shortDescription": {"text": "Commented-code block (5 lines) in packages/@sanity/pkg-utils/src/node/tasks/rolldown/resolveRolldownConfig.ts:163"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18911"}, "properties": {"repository": "sanity-io/pkg-utils", "repoUrl": "https://github.com/sanity-io/pkg-utils", "branch": "main"}, "results": [{"ruleId": "scanner-768220b0f4502d10", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 playground/runtime-node-module/index.js:4"}, "properties": {"repobilityId": "6322510d438e4717", "scanner": "scanner-primary", "fingerprint": "768220b0f4502d10", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cecde52f8c0013d4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 playground/multi-exports-commonjs/src/cli.ts:6"}, "properties": {"repobilityId": "c3cf8f39adb5efbb", "scanner": "scanner-primary", "fingerprint": "cecde52f8c0013d4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3dc537216aec273b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 playground/runtime-node-commonjs/index.js:4"}, "properties": {"repobilityId": "c999062bd83690a6", "scanner": "scanner-primary", "fingerprint": "3dc537216aec273b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-08a9f427869228fb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 playground/dummy-side-effects/side-effect.js:1"}, "properties": {"repobilityId": "391c6c50dac37adc", "scanner": "scanner-primary", "fingerprint": "08a9f427869228fb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4b8b0db755b2ec3a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/spinner.ts:10"}, "properties": {"repobilityId": "d68aed0d10e4c3fb", "scanner": "scanner-primary", "fingerprint": "4b8b0db755b2ec3a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-65e26b054c06697c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/build.ts:24"}, "properties": {"repobilityId": "3b8625b125c92c1f", "scanner": "scanner-primary", "fingerprint": "65e26b054c06697c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-837e88ebcd972149", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/@sanity/pkg-utils/src/node/logger.ts:17"}, "properties": {"repobilityId": "f053ed0f2a6e8f98", "scanner": "scanner-primary", "fingerprint": "837e88ebcd972149", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9b5139f431d5b266", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/@sanity/tsdown-config/test/fixtures/react-19-library/src/Button.tsx:6"}, "properties": {"repobilityId": "fab72ca4f23fc6b6", "scanner": "scanner-primary", "fingerprint": "9b5139f431d5b266", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f388fd6bfe8ce531", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in playground/runtime-vite/src/main.ts:7"}, "properties": {"repobilityId": "59ca2ccc19b5306d", "scanner": "scanner-primary", "fingerprint": "f388fd6bfe8ce531", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/runtime-vite/src/main.ts"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-1cf3c54f2ee7c999", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "d8bf8a9a55de6a24", "scanner": "scanner-primary", "fingerprint": "1cf3c54f2ee7c999", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/format-if-needed.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-0337ea5f616c60ca", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "de61f737801a61b0", "scanner": "scanner-primary", "fingerprint": "0337ea5f616c60ca", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/renovate.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-e2dd8b4c4ff10305", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "ce85c72970e054ce", "scanner": "scanner-primary", "fingerprint": "e2dd8b4c4ff10305", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-50e712dbde9ed7f0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/dummy-lodash-es/package.json"}, "properties": {"repobilityId": "2837629de4e266de", "scanner": "scanner-primary", "fingerprint": "50e712dbde9ed7f0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/dummy-lodash-es/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-327dcac738c8f42c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/dummy-lodash/package.json"}, "properties": {"repobilityId": "710d334885f1aaa9", "scanner": "scanner-primary", "fingerprint": "327dcac738c8f42c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/dummy-lodash/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-036640edd00b0af1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-vite/package.json"}, "properties": {"repobilityId": "e7bff5f8822037e3", "scanner": "scanner-primary", "fingerprint": "036640edd00b0af1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/runtime-vite/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32ee1aa391af8263", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/tsgo/package.json"}, "properties": {"repobilityId": "6100300575e6dc5e", "scanner": "scanner-primary", "fingerprint": "32ee1aa391af8263", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/tsgo/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5349760c90d50f8b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-peer-dependency/package.json"}, "properties": {"repobilityId": "e6069293d8987bc1", "scanner": "scanner-primary", "fingerprint": "5349760c90d50f8b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/ts-rolldown-bundle-peer-dependency/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9d78057b8acdc21", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-astro/package.json"}, "properties": {"repobilityId": "a5a6e0f6034ed43f", "scanner": "scanner-primary", "fingerprint": "d9d78057b8acdc21", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/runtime-astro/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-746cf2205b365359", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-node-module/package.json"}, "properties": {"repobilityId": "47af1755e10c6798", "scanner": "scanner-primary", "fingerprint": "746cf2205b365359", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/runtime-node-module/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a32f3eae3170d21b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/sanity-plugin-with-vanilla-extract/package.json"}, "properties": {"repobilityId": "d8fff5ec3b0ca4ec", "scanner": "scanner-primary", "fingerprint": "a32f3eae3170d21b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/sanity-plugin-with-vanilla-extract/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e15219017f4fa2a5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/tsgo-disabled/package.json"}, "properties": {"repobilityId": "1513f7ce3df07ace", "scanner": "scanner-primary", "fingerprint": "e15219017f4fa2a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/tsgo-disabled/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7d658a50eec48d2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/babel-plugin/package.json"}, "properties": {"repobilityId": "2c020c94800de619", "scanner": "scanner-primary", "fingerprint": "d7d658a50eec48d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/babel-plugin/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78172e1c7fa12a75", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/use-client-directive/package.json"}, "properties": {"repobilityId": "7724fdbfb76c8b09", "scanner": "scanner-primary", "fingerprint": "78172e1c7fa12a75", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/use-client-directive/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d82e1b419b6fd854", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/reference-cjs/package.json"}, "properties": {"repobilityId": "17364fcf4f076f07", "scanner": "scanner-primary", "fingerprint": "d82e1b419b6fd854", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/reference-cjs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e689febeb8d0fe1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-next-js/package.json"}, "properties": {"repobilityId": "e2e3fb391bf11509", "scanner": "scanner-primary", "fingerprint": "4e689febeb8d0fe1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/runtime-next-js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-130c087062ab71b2", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/reference-esm/package.json"}, "properties": {"repobilityId": "f13d9e3082c2c30f", "scanner": "scanner-primary", "fingerprint": "130c087062ab71b2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/reference-esm/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f6252a0601c91d0", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/multi-export/package.json"}, "properties": {"repobilityId": "0364b6ff17de9688", "scanner": "scanner-primary", "fingerprint": "0f6252a0601c91d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/multi-export/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e22f6b77512ace8d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/react-19/package.json"}, "properties": {"repobilityId": "51140598897c7872", "scanner": "scanner-primary", "fingerprint": "e22f6b77512ace8d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/react-19/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-312160e2431967d3", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/sanity-plugin-with-styled-components/package.json"}, "properties": {"repobilityId": "31d6e854eaf553eb", "scanner": "scanner-primary", "fingerprint": "312160e2431967d3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/sanity-plugin-with-styled-components/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6cd5feb391fd794b", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/reference-esm-only/package.json"}, "properties": {"repobilityId": "e54ffe65b42bc0f3", "scanner": "scanner-primary", "fingerprint": "6cd5feb391fd794b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/reference-esm-only/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-affe6f166ff2ac22", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/react-18/package.json"}, "properties": {"repobilityId": "5a14225e35a6740e", "scanner": "scanner-primary", "fingerprint": "affe6f166ff2ac22", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/react-18/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66ac04c1fc060bdb", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-prod-dependency/package.json"}, "properties": {"repobilityId": "b4f0fa97ad0c6f05", "scanner": "scanner-primary", "fingerprint": "66ac04c1fc060bdb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/ts-rolldown-bundle-prod-dependency/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-edd80643af7a27e7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-bundle-dev-dependency/package.json"}, "properties": {"repobilityId": "458971582d5d7c22", "scanner": "scanner-primary", "fingerprint": "edd80643af7a27e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/ts-rolldown-bundle-dev-dependency/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-04d3fe497c607728", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/strict-legacy-fields/package.json"}, "properties": {"repobilityId": "1824c42b72117692", "scanner": "scanner-primary", "fingerprint": "04d3fe497c607728", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/strict-legacy-fields/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e02367a9d7cb1eb7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-external-subpath-import/package.json"}, "properties": {"repobilityId": "e581a594d945be23", "scanner": "scanner-primary", "fingerprint": "e02367a9d7cb1eb7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/ts-rolldown-external-subpath-import/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1057be62a9135c8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/runtime-node-commonjs/package.json"}, "properties": {"repobilityId": "3b2ae3fef40e16c9", "scanner": "scanner-primary", "fingerprint": "d1057be62a9135c8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/runtime-node-commonjs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fc3defaa7f8e4ca9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: playground/ts-rolldown-inline-types-external-js/package.json"}, "properties": {"repobilityId": "5b8d6ee167b1df4c", "scanner": "scanner-primary", "fingerprint": "fc3defaa7f8e4ca9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "playground/ts-rolldown-inline-types-external-js/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f99c77287868d18", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/@sanity/pkg-utils/package.json"}, "properties": {"repobilityId": "e219acb9034ac543", "scanner": "scanner-primary", "fingerprint": "4f99c77287868d18", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/@sanity/pkg-utils/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-29c34b7446de4478", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/@sanity/parse-package-json/package.json"}, "properties": {"repobilityId": "3dbac7c20c36d2be", "scanner": "scanner-primary", "fingerprint": "29c34b7446de4478", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/@sanity/parse-package-json/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18836b9dd62314a9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/@sanity/tsdown-config/package.json"}, "properties": {"repobilityId": "d4bcef0c9b43c3ad", "scanner": "scanner-primary", "fingerprint": "18836b9dd62314a9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/@sanity/tsdown-config/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b1941197d43a762d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/@sanity/tsdown-config/test/fixtures/react-19-library/package.json"}, "properties": {"repobilityId": "46984bc5852cd32b", "scanner": "scanner-primary", "fingerprint": "b1941197d43a762d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/@sanity/tsdown-config/test/fixtures/react-19-library/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "fb2c0e1450633101", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2f21368a3db157c9", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a8068ab26e05e509", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5854383adcb90097", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-6a8b2c4dacd7c473", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/@sanity/pkg-utils/src/node/tasks/rolldown/resolveRolldownConfig.ts:163"}, "properties": {"repobilityId": "133e86358f26d79c", "scanner": "scanner-primary", "fingerprint": "6a8b2c4dacd7c473", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}