astral-sh/uv

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

Scan timing: clone 4.63s · analysis 10.16s · 27.9 MB · GitHub API rate-limit (preflight)

https://github.com/astral-sh/uv · scanned 2026-05-31 01:25 UTC (1 week, 6 days ago) · 10 languages

493 raw signals (142 security + 351 graph) 11/13 scanners ran 50th percentile · Rust · huge (>500K LoC) System graph score 73 (higher by 11)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 1 week, 6 days ago · v2 · 203 actionable findings from 2 signal sources. 117 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

100.0% cov · 148 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	100.0	0.25	25.00
`testing_score`	84.0	0.20	16.80
`documentation_score`	100.0	0.15	15.00
`practices_score`	100.0	0.15	15.00
`code_quality`	35.0	0.10	3.50
Overall		1.00	84.3

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: severity: high × excluding tests × Reset all

Severity: Critical 8 High 20 Medium 22 Low 116 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 55 System graph 148 Crowd 0 Layer: Quality 147 Software 31 Cicd 6 Security 12 Api 1 Network 2 Hardware 3 Frontend 1

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Strongest documentation (84), structure (78); weakest security (40), practices (47). Most common pattern: ts-non-null-assertion.

Showing 20 of 203 actionable findings. 320 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks quality Quality conf 1.00 ✓ Repobility [MINED106] Phantom test coverage: test_file: Test function `test_file` runs code but contains no assert / expect / should call — it passes regardless of behaviour. Adds line coverage without verifying anything.

Add an explicit assertion that captures the test's intent, or remove the test.

scripts/scenarios/generate.py:84

high Security checks quality Quality conf 1.00 ✓ Repobility 25 occurrences [MINED108] `self.resolve_cold` used but never assigned in __init__: Method `command` of class `Suite` reads `self.resolve_cold`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance.

Initialize `self.resolve_cold = <default>` in __init__, or add a class-level default.

3 files, 25 locations

scripts/benchmark/src/benchmark/resolver.py:94, 96, 98, 100, 102, 104, 389, 416, +12 more (20 hits)

scripts/benchmark/src/benchmark/tools.py:36, 38, 40 (3 hits)

scripts/scenarios/generate.py:82, 85 (2 hits)

high Security checks software dependencies conf 0.90 ✓ Repobility [MINED118] Dockerfile FROM `ubuntu:22.04` not pinned by digest: `FROM ubuntu:22.04` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Replace with: `FROM ubuntu:22.04@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot).

crates/uv-dev/builder.dockerfile:3

high Security checks software dependencies conf 0.90 ✓ Repobility 7 occurrences [MINED126] Workflow container/services image `quay.io/pypa/manylinux2014` unpinned: `container/services image: quay.io/pypa/manylinux2014` without `@sha256:...` pulls a mutable tag at workflow-run time. Treat workflow container references with the same supply-chain discipline as Dockerfile FROM lines.

Replace with `quay.io/pypa/manylinux2014@sha256:<digest>`. Re-pin via Dependabot Docker scope.

3 files, 7 locations

.github/workflows/test-system.yml:102, 126, 299, 377, 790 (5 hits)

.github/workflows/build-release-binaries.yml:361

.github/workflows/test-smoke.yml:78

high Security checks software dependencies conf 0.90 ✓ Repobility 3 occurrences [MINED131] pre-commit hook `https://github.com/abravalheri/validate-pyproject` pinned to mutable rev `v0.24.1`: `.pre-commit-config.yaml` references `https://github.com/abravalheri/validate-pyproject` at `rev: v0.24.1`. If `{rev}` is a branch or version tag, the repo owner can push new code there and `pre-commit install --install-hooks` will fetch it on every developer's machine.

Pin to a commit SHA: `rev: <40-char-sha>` and bump it through `pre-commit autoupdate` (which writes to PRs that are reviewed).

lines 9, 13, 45

.pre-commit-config.yaml:9, 13, 45 (3 hits)

high Security checks software dependencies conf 0.90 ✓ Repobility [MINED134] Binary file `crates/uv-trampoline-builder/trampolines/uv-trampoline-aarch64-console.exe` committed in source repo: `crates/uv-trampoline-builder/trampolines/uv-trampoline-aarch64-console.exe` is a .exe binary (45,568 bytes) committed to a repo that otherwise has 705 source files. Trojan binaries inside otherwise-normal source repos are a known supply-chain attack: a compromised dependency or PR slips in a binary that gets executed by build scripts.