{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d9ce78924724a624", "name": "Possibly dead Python function: to_json", "shortDescription": {"text": "Possibly dead Python function: to_json"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40146f9914180398", "name": "CVE-2026-45409: idna 3.11 \u2014 poetry.lock", "shortDescription": {"text": "CVE-2026-45409: idna 3.11 \u2014 poetry.lock"}, "fullDescription": {"text": "python-idna: idna: Denial of Service via specially crafted long inputs\n\nInternationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi\n\nPackage: idna\nInstalled: 3.11\nFixed in: 3.15\nSeverity: MEDIUM\nFix: Upgrade idna to 3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddeac66df49d9a43", "name": "CVE-2026-25645: requests 2.32.5 \u2014 poetry.lock", "shortDescription": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 poetry.lock"}, "fullDescription": {"text": "requests: Requests: Security bypass due to predictable temporary file creation\n\nRequests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner\n\nPackage: requests\nInstalled: 2.32.5\nFixed in: 2.33.0\nSeverity: MEDIUM\nFix: Upgrade requests to 2.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d549cdfe02fda0b9", "name": "CVE-2026-21441: urllib3 2.6.2 \u2014 poetry.lock", "shortDescription": {"text": "CVE-2026-21441: urllib3 2.6.2 \u2014 poetry.lock"}, "fullDescription": {"text": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)\n\nurllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in ve\n\nPackage: urllib3\nInstalled: 2.6.2\nFixed in: 2.6.3\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.6.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0cc335fa65b52aee", "name": "CVE-2026-44431: urllib3 2.6.2 \u2014 poetry.lock", "shortDescription": {"text": "CVE-2026-44431: urllib3 2.6.2 \u2014 poetry.lock"}, "fullDescription": {"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers\n\nurllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.\n\nPackage: urllib3\nInstalled: 2.6.2\nFixed in: 2.7.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0acabe801db01b3c", "name": "CVE-2026-44432: urllib3 2.6.2 \u2014 poetry.lock", "shortDescription": {"text": "CVE-2026-44432: urllib3 2.6.2 \u2014 poetry.lock"}, "fullDescription": {"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression\n\nurllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly \n\nPackage: urllib3\nInstalled: 2.6.2\nFixed in: 2.7.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63287eac339e111d", "name": "Vulnerable dependency requests 2.32.5: GHSA-gc5v-m9x4-r6x2", "shortDescription": {"text": "Vulnerable dependency requests 2.32.5: GHSA-gc5v-m9x4-r6x2"}, "fullDescription": {"text": "OSV.dev reports `requests` at version `2.32.5` (resolved in `poetry.lock`) is affected by GHSA-gc5v-m9x4-r6x2 (aka CVE-2026-25645).\n\nRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility function\n\nAliases: CVE-2026-25645, GHSA-gc5v-m9x4-r6x2, PYSEC-2026-2275\nAdvisory: https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2\nFix: upgrade `requests` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c902eee3470311d0", "name": "Vulnerable dependency requests 2.31.0: GHSA-9hjg-9r4m-mvj7", "shortDescription": {"text": "Vulnerable dependency requests 2.31.0: GHSA-9hjg-9r4m-mvj7"}, "fullDescription": {"text": "OSV.dev reports `requests` at version `2.31.0` (declared in `pyproject.toml`) is affected by GHSA-9hjg-9r4m-mvj7 (aka CVE-2024-47081).\nNote: `2.31.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nRequests vulnerable to .netrc credentials leak via malicious URLs\n\nAliases: CVE-2024-47081, GHSA-9hjg-9r4m-mvj7, PYSEC-2026-1872\nAdvisory: https://osv.dev/vulnerability/GHSA-9hjg-9r4m-mvj7\nFix: upgrade `requests` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-53e8277628837568", "name": "Vulnerable dependency requests 2.31.0: GHSA-9wx4-h78v-vm56", "shortDescription": {"text": "Vulnerable dependency requests 2.31.0: GHSA-9wx4-h78v-vm56"}, "fullDescription": {"text": "OSV.dev reports `requests` at version `2.31.0` (declared in `pyproject.toml`) is affected by GHSA-9wx4-h78v-vm56 (aka CVE-2024-35195).\nNote: `2.31.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nRequests `Session` object does not verify requests after making first request with verify=False\n\nAliases: CVE-2024-35195, GHSA-9wx4-h78v-vm56, PYSEC-2026-1873\nAdvisory: https://osv.dev/vulnerability/GHSA-9wx4-h78v-vm56\nFix: upgrade `requests` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-5d50419fa3e6d023", "name": "Vulnerable dependency requests 2.31.0: GHSA-gc5v-m9x4-r6x2", "shortDescription": {"text": "Vulnerable dependency requests 2.31.0: GHSA-gc5v-m9x4-r6x2"}, "fullDescription": {"text": "OSV.dev reports `requests` at version `2.31.0` (declared in `pyproject.toml`) is affected by GHSA-gc5v-m9x4-r6x2 (aka CVE-2026-25645).\nNote: `2.31.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nRequests has Insecure Temp File Reuse in its extract_zipped_paths() utility function\n\nAliases: CVE-2026-25645, GHSA-gc5v-m9x4-r6x2, PYSEC-2026-2275\nAdvisory: https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2\nFix: upgrade `requests` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-44c10c43c1b173e9", "name": "Vulnerable dependency tqdm 4.66.0: GHSA-g7vv-2v7x-gj9p", "shortDescription": {"text": "Vulnerable dependency tqdm 4.66.0: GHSA-g7vv-2v7x-gj9p"}, "fullDescription": {"text": "OSV.dev reports `tqdm` at version `4.66.0` (declared in `pyproject.toml`) is affected by GHSA-g7vv-2v7x-gj9p (aka CVE-2024-34062).\nNote: `4.66.0` is the declared floor of a range \u2014 the installed version may be newer.\n\ntqdm CLI arguments injection attack\n\nAliases: CVE-2024-34062, GHSA-g7vv-2v7x-gj9p, PYSEC-2026-1976\nAdvisory: https://osv.dev/vulnerability/GHSA-g7vv-2v7x-gj9p\nFix: upgrade `tqdm` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.7}}, {"id": "scanner-7ef338858214b7a9", "name": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx", "shortDescription": {"text": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx"}, "fullDescription": {"text": "OSV.dev reports `idna` at version `3.11` (resolved in `poetry.lock`) is affected by GHSA-65pc-fj4g-8rjx (aka CVE-2026-45409).\nNote: `idna` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nInternationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix\n\nAliases: CVE-2026-45409, GHSA-65pc-fj4g-8rjx, PYSEC-2026-215\nAdvisory: https://osv.dev/vulnerability/GHSA-65pc-fj4g-8rjx\nFix: upgrade `idna` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ab8a4d86d9224986", "name": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq", "shortDescription": {"text": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq"}, "fullDescription": {"text": "OSV.dev reports `pygments` at version `2.19.2` (resolved in `poetry.lock`) is affected by GHSA-5239-wwwm-4pmq (aka CVE-2026-4539).\nNote: `pygments` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nPygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching\n\nAliases: CVE-2026-4539, GHSA-5239-wwwm-4pmq, PYSEC-2026-2987\nAdvisory: https://osv.dev/vulnerability/GHSA-5239-wwwm-4pmq\nFix: upgrade `pygments` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-76f2284604b3b0d9", "name": "Vulnerable dependency pytest 7.4.4: GHSA-6w46-j5rx-g56g", "shortDescription": {"text": "Vulnerable dependency pytest 7.4.4: GHSA-6w46-j5rx-g56g"}, "fullDescription": {"text": "OSV.dev reports `pytest` at version `7.4.4` (resolved in `poetry.lock`) is affected by GHSA-6w46-j5rx-g56g (aka CVE-2025-71176).\nNote: `pytest` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\npytest has vulnerable tmpdir handling\n\nAliases: CVE-2025-71176, GHSA-6w46-j5rx-g56g, PYSEC-2026-1845\nAdvisory: https://osv.dev/vulnerability/GHSA-6w46-j5rx-g56g\nFix: upgrade `pytest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d8d9ff223a75ddcd", "name": "Vulnerable dependency urllib3 2.6.2: GHSA-38jv-5279-wg99", "shortDescription": {"text": "Vulnerable dependency urllib3 2.6.2: GHSA-38jv-5279-wg99"}, "fullDescription": {"text": "OSV.dev reports `urllib3` at version `2.6.2` (resolved in `poetry.lock`) is affected by GHSA-38jv-5279-wg99 (aka CVE-2026-21441).\nNote: `urllib3` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nDecompression-bomb safeguards bypassed when following HTTP redirects (streaming API)\n\nAliases: CVE-2026-21441, GHSA-38jv-5279-wg99, PYSEC-2026-1996\nAdvisory: https://osv.dev/vulnerability/GHSA-38jv-5279-wg99\nFix: upgrade `urllib3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "critical", "confidence": 0.9}}, {"id": "scanner-874cc2cf4a228620", "name": "Vulnerable dependency urllib3 2.6.2: GHSA-mf9v-mfxr-j63j", "shortDescription": {"text": "Vulnerable dependency urllib3 2.6.2: GHSA-mf9v-mfxr-j63j"}, "fullDescription": {"text": "OSV.dev reports `urllib3` at version `2.6.2` (resolved in `poetry.lock`) is affected by GHSA-mf9v-mfxr-j63j (aka CVE-2026-44432).\nNote: `urllib3` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nurllib3: Decompression-bomb safeguards bypassed in parts of the streaming API\n\nAliases: CVE-2026-44432, GHSA-mf9v-mfxr-j63j, PYSEC-2026-142\nAdvisory: https://osv.dev/vulnerability/GHSA-mf9v-mfxr-j63j\nFix: upgrade `urllib3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "critical", "confidence": 0.9}}, {"id": "scanner-61a09cc96cc4a869", "name": "Vulnerable dependency urllib3 2.6.2: GHSA-qccp-gfcp-xxvc", "shortDescription": {"text": "Vulnerable dependency urllib3 2.6.2: GHSA-qccp-gfcp-xxvc"}, "fullDescription": {"text": "OSV.dev reports `urllib3` at version `2.6.2` (resolved in `poetry.lock`) is affected by GHSA-qccp-gfcp-xxvc (aka CVE-2026-44431).\nNote: `urllib3` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nurllib3: Sensitive headers forwarded across origins in proxied low-level redirects\n\nAliases: CVE-2026-44431, GHSA-qccp-gfcp-xxvc, PYSEC-2026-141\nAdvisory: https://osv.dev/vulnerability/GHSA-qccp-gfcp-xxvc\nFix: upgrade `urllib3` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-a87b4995c78a9587", "name": "Declared dependency is not found on the public registry: python", "shortDescription": {"text": "Declared dependency is not found on the public registry: python"}, "fullDescription": {"text": "`python` is declared in `pyproject.toml`, but two independent lookups did not find it on the public pypi registry after applying the local/workspace/git/url/npm-alias/self-name/private-index gates. This can be a typo, private package not modeled as local, dependency-confusion exposure, or an AI-hallucinated package name."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afa874e53aafa2de", "name": "Dependency pandas is a major version behind", "shortDescription": {"text": "Dependency pandas is a major version behind"}, "fullDescription": {"text": "`pandas` is pinned at `2.0.0` in `pyproject.toml` while the latest release on the pypi registry is `3.0.5` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `pandas` to `3.0.5`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30819"}, "properties": {"repository": "yutongquan/rijksmuseum_py", "repoUrl": "https://github.com/yutongquan/rijksmuseum_py", "branch": "main"}, "results": [{"ruleId": "scanner-d9ce78924724a624", "level": "note", "message": {"text": "Possibly dead Python function: to_json"}, "properties": {"repobilityId": "15c96a95a5f38c8f", "scanner": "scanner-primary", "fingerprint": "d9ce78924724a624", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/rijksmuseum_py/rijksmuseum_py.py:134"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-40146f9914180398", "level": "warning", "message": {"text": "CVE-2026-45409: idna 3.11 \u2014 poetry.lock"}, "properties": {"repobilityId": "bfd1aeaaf05ff89a", "scanner": "scanner-primary", "fingerprint": "40146f9914180398", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45409"]}}, {"ruleId": "scanner-ddeac66df49d9a43", "level": "warning", "message": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 poetry.lock"}, "properties": {"repobilityId": "f7e88863cc19e3cc", "scanner": "scanner-primary", "fingerprint": "ddeac66df49d9a43", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25645"]}}, {"ruleId": "scanner-d549cdfe02fda0b9", "level": "error", "message": {"text": "CVE-2026-21441: urllib3 2.6.2 \u2014 poetry.lock"}, "properties": {"repobilityId": "5ff892243970b355", "scanner": "scanner-primary", "fingerprint": "d549cdfe02fda0b9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-21441"]}}, {"ruleId": "scanner-0cc335fa65b52aee", "level": "error", "message": {"text": "CVE-2026-44431: urllib3 2.6.2 \u2014 poetry.lock"}, "properties": {"repobilityId": "a48bb516680715ed", "scanner": "scanner-primary", "fingerprint": "0cc335fa65b52aee", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44431"]}}, {"ruleId": "scanner-0acabe801db01b3c", "level": "error", "message": {"text": "CVE-2026-44432: urllib3 2.6.2 \u2014 poetry.lock"}, "properties": {"repobilityId": "7440153b067fb79d", "scanner": "scanner-primary", "fingerprint": "0acabe801db01b3c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44432"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-63287eac339e111d", "level": "warning", "message": {"text": "Vulnerable dependency requests 2.32.5: GHSA-gc5v-m9x4-r6x2"}, "properties": {"repobilityId": "5a83342b2ace364f", "scanner": "scanner-primary", "fingerprint": "63287eac339e111d", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gc5v-m9x4-r6x2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c902eee3470311d0", "level": "warning", "message": {"text": "Vulnerable dependency requests 2.31.0: GHSA-9hjg-9r4m-mvj7"}, "properties": {"repobilityId": "9bffdb2814b413ff", "scanner": "scanner-primary", "fingerprint": "c902eee3470311d0", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-9hjg-9r4m-mvj7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53e8277628837568", "level": "warning", "message": {"text": "Vulnerable dependency requests 2.31.0: GHSA-9wx4-h78v-vm56"}, "properties": {"repobilityId": "2a2ebbe47742c45e", "scanner": "scanner-primary", "fingerprint": "53e8277628837568", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-9wx4-h78v-vm56"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5d50419fa3e6d023", "level": "warning", "message": {"text": "Vulnerable dependency requests 2.31.0: GHSA-gc5v-m9x4-r6x2"}, "properties": {"repobilityId": "2768d16140e92353", "scanner": "scanner-primary", "fingerprint": "5d50419fa3e6d023", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-gc5v-m9x4-r6x2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44c10c43c1b173e9", "level": "note", "message": {"text": "Vulnerable dependency tqdm 4.66.0: GHSA-g7vv-2v7x-gj9p"}, "properties": {"repobilityId": "701d81d99468f25b", "scanner": "scanner-primary", "fingerprint": "44c10c43c1b173e9", "layer": "dependencies", "severity": "low", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-g7vv-2v7x-gj9p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7ef338858214b7a9", "level": "warning", "message": {"text": "Vulnerable dependency idna 3.11: GHSA-65pc-fj4g-8rjx"}, "properties": {"repobilityId": "fb9a242b2a48123b", "scanner": "scanner-primary", "fingerprint": "7ef338858214b7a9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-65pc-fj4g-8rjx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ab8a4d86d9224986", "level": "note", "message": {"text": "Vulnerable dependency pygments 2.19.2: GHSA-5239-wwwm-4pmq"}, "properties": {"repobilityId": "b5634ffa34a95a85", "scanner": "scanner-primary", "fingerprint": "ab8a4d86d9224986", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-5239-wwwm-4pmq", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-76f2284604b3b0d9", "level": "warning", "message": {"text": "Vulnerable dependency pytest 7.4.4: GHSA-6w46-j5rx-g56g"}, "properties": {"repobilityId": "5570e193a35ff1e6", "scanner": "scanner-primary", "fingerprint": "76f2284604b3b0d9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6w46-j5rx-g56g", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8d9ff223a75ddcd", "level": "error", "message": {"text": "Vulnerable dependency urllib3 2.6.2: GHSA-38jv-5279-wg99"}, "properties": {"repobilityId": "38e527faef80a160", "scanner": "scanner-primary", "fingerprint": "d8d9ff223a75ddcd", "layer": "dependencies", "severity": "critical", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-38jv-5279-wg99", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-874cc2cf4a228620", "level": "error", "message": {"text": "Vulnerable dependency urllib3 2.6.2: GHSA-mf9v-mfxr-j63j"}, "properties": {"repobilityId": "30a7e8ee638bb5b1", "scanner": "scanner-primary", "fingerprint": "874cc2cf4a228620", "layer": "dependencies", "severity": "critical", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mf9v-mfxr-j63j", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-61a09cc96cc4a869", "level": "error", "message": {"text": "Vulnerable dependency urllib3 2.6.2: GHSA-qccp-gfcp-xxvc"}, "properties": {"repobilityId": "47a4661d522fe392", "scanner": "scanner-primary", "fingerprint": "61a09cc96cc4a869", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qccp-gfcp-xxvc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "poetry.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a87b4995c78a9587", "level": "warning", "message": {"text": "Declared dependency is not found on the public registry: python"}, "properties": {"repobilityId": "64ba3f3b5d7d69c6", "scanner": "scanner-primary", "fingerprint": "a87b4995c78a9587", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "resolvability", "dependency-confusion", "ai-generated-signal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-afa874e53aafa2de", "level": "note", "message": {"text": "Dependency pandas is a major version behind"}, "properties": {"repobilityId": "15270db400a83876", "scanner": "scanner-primary", "fingerprint": "afa874e53aafa2de", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pyproject.toml"}, "region": {"startLine": 1}}}]}]}]}