nodejs/node

Component	Sub-score	Weight	Contribution
`structure_score`	85.0	0.15	12.75
`security_score`	100.0	0.25	25.00
`testing_score`	92.0	0.20	18.40
`documentation_score`	88.0	0.15	13.20
`practices_score`	87.0	0.15	13.05
`code_quality`	56.0	0.10	5.60
Overall		1.00	88.0

medium Legacy quality error_handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

benchmark/process/handled-rejections.js:34 error_handlinglegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `__init__` (list): `def __init__(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def __init__(x=None): x = x or []`

deps/v8/tools/dev/gm.py:539 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `__init__` (list): `def __init__(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def __init__(x=None): x = x or []`

deps/v8/tools/dev/gm.py:428 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `AddDebugSettings` (dict): `def AddDebugSettings(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def AddDebugSettings(x=None): x = x or []`

tools/gyp/pylib/gyp/MSVSUserFile.py:79 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `AddImplicitPostbuilds` (list): `def AddImplicitPostbuilds(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def AddImplicitPostbuilds(x=None): x = x or []`

tools/gyp/pylib/gyp/xcode_emulation.py:1236 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `ClangTidyRunSingleFile` (list): `def ClangTidyRunSingleFile(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def ClangTidyRunSingleFile(x=None): x = x or []`

deps/v8/tools/run-clang-tidy.py:221 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `CopyTool` (dict): `def CopyTool(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def CopyTool(x=None): x = x or []`

tools/gyp/pylib/gyp/common.py:526 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `extend` (list): `def extend(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def extend(x=None): x = x or []`

deps/v8/tools/dev/gm.py:435 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `GenerateCompileDBWithNinja` (list): `def GenerateCompileDBWithNinja(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def GenerateCompileDBWithNinja(x=None): x = x or []`

tools/gyp/pylib/gyp/generator/ninja.py:2885 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `Load` (dict): `def Load(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def Load(x=None): x = x or []`

tools/gyp/pylib/gyp/__init__.py:71 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `Load` (list): `def Load(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def Load(x=None): x = x or []`

tools/gyp/pylib/gyp/__init__.py:71 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `man_role` (dict): `def man_role(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def man_role(x=None): x = x or []`

deps/uv/docs/src/sphinx-plugins/manpage.py:30 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `man_role` (list): `def man_role(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def man_role(x=None): x = x or []`

deps/uv/docs/src/sphinx-plugins/manpage.py:30 qualitylegacy

medium Legacy quality quality conf 1.00 ✓ Repobility [MINED109] Mutable default argument in `ptr_arg_cmd` (list): `def ptr_arg_cmd(... = []/{}/set())` — Python's default value is constructed ONCE at function definition time and shared across all calls. Mutating it in one call mutates it for every future call too.

Use None as the default and create the collection inside the function: `def ptr_arg_cmd(x=None): x = x or []`

deps/v8/tools/lldb_commands.py:46 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

benchmark/process/bench-env.js:32 qualitylegacy

medium Legacy quality quality conf 1.00 [SEC123] Production stack trace / debug output exposed: Debug mode left on in production exposes stack traces, environment variables, framework internals — sometimes triggers RCE (Django debug page with arbitrary template eval).

Set DEBUG=False / APP_DEBUG=false in production. Provide a generic 500 handler that logs to backend but returns a sanitized page to clients.

deps/LIEF/include/LIEF/PE/Builder.hpp:83 qualitylegacy

medium Legacy cicd docker conf 0.90 Docker build context has no .dockerignore

Add .dockerignore with at least .git, .env, private keys, dependency folders, build outputs, and local databases.

.dockerignore dockerlegacy

medium Legacy cicd docker conf 0.84 Docker build context is very large

Shrink the build context with .dockerignore, move generated/runtime data outside the build context, and copy only the manifest files needed for cached dependency layers.

.dockerignore dockerlegacy

medium Legacy quality quality conf 0.70 Public web app has no Content Security Policy

Add a Content-Security-Policy header through the web framework or hosting config. For static apps, add a CSP meta tag that restricts default-src, script-src, connect-src, img-src, and frame-ancestors.

index.html qualitylegacy

medium Legacy quality quality conf 0.78 Public web service has no security.txt

Add /.well-known/security.txt with Contact, Expires, Canonical, Preferred-Languages, and Policy fields. Keep the contact endpoint monitored.

.well-known/security.txt qualitylegacy

medium Legacy quality quality conf 0.72 Service worker is present without a web app manifest

Add a valid manifest.json or site.webmanifest and reference it from the document head. Include name, icons, start_url, display, and theme colors.

manifest.json qualitylegacy

medium Legacy quality quality conf 0.78 Suspicious implementation file appears unreferenced

Confirm whether this file is reachable. If not, delete it; if yes, wire it through explicit imports, routes, or entry points and add a test that proves the path executes.

deps/openssl/openssl/crypto/asn1/tasn_new.c:1 qualitylegacy

medium Legacy quality quality conf 0.78 Suspicious implementation file appears unreferenced

Confirm whether this file is reachable. If not, delete it; if yes, wire it through explicit imports, routes, or entry points and add a test that proves the path executes.

deps/LIEF/third-party/mbedtls/library/ecp_internal_alt.h:1 qualitylegacy

medium Legacy quality quality conf 0.78 Suspicious implementation file appears unreferenced

Confirm whether this file is reachable. If not, delete it; if yes, wire it through explicit imports, routes, or entry points and add a test that proves the path executes.

deps/LIEF/third-party/mbedtls/library/ecp_curves_new.c:1 qualitylegacy

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/npm/lib/commands/token.js:136

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/npm/lib/utils/oidc.js:78

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/undici/src/lib/web/fetch/index.js:182

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/undici/src/types/fetch.d.ts:14

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/undici/src/types/formdata.d.ts:13

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/v8/test/inspector/debugger/evaluate-with-await-on-breakpoint.js:30

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/v8/tools/heap-stats/helper.js:27

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/v8/tools/turbolizer/src/views/info-view.ts:10

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — deps/v8/tools/zone-stats/helper.js:27

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — lib/internal/bootstrap/web/exposed-window-or-worker.js:78

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — lib/internal/wasm_web_api.js:17

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — test/common/wpt/worker.js:30

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — test/es-module/test-wasm-web-api.js:16

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — test/parallel/test-blob.js:339

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — test/parallel/test-fetch-mock.js:15

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — test/parallel/test-inspector-network-content-type.js:13

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — test/parallel/test-inspector-network-fetch.js:153

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

integrityfragile-runtimerobustness

medium 9-layer hardware security conf 1.00 Dockerfile runs as root: deps/openssl/config/Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

securitycontainer

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/create-release-proposal.yml supply-chaingithub-actionsleast-privilege

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/scorecard.yml supply-chaingithub-actionsleast-privilege

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/license-builder.yml supply-chaingithub-actionsleast-privilege

medium 9-layer cicd supply-chain conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/timezone-update.yml supply-chaingithub-actionsleast-privilege

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/third_party/ittapi/buildall.py:90

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/third_party/ittapi/buildall.py:90 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/android-run.py:57

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/android-run.py:57 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/clusterfuzz/js_fuzzer/tools/fuzz_one.py:39

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/clusterfuzz/js_fuzzer/tools/fuzz_one.py:39 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/clusterfuzz/js_fuzzer/tools/run_one.py:58

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/clusterfuzz/js_fuzzer/tools/run_one.py:58 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/dev/gen-tags.py:37

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/dev/gen-tags.py:37 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/dev/gm.py:324

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/dev/gm.py:324 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/dev/setup-reclient.py:39

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/dev/setup-reclient.py:39 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/dev/update-compile-commands.py:43

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/dev/update-compile-commands.py:43 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/disasm.py:79

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/disasm.py:79 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/locs.py:142

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/locs.py:142 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/memory/rss.py:56

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/memory/rss.py:56 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/profiling/linux-perf-chrome.py:314

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/profiling/linux-perf-chrome.py:314 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/profiling/linux-perf-d8.py:292

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/profiling/linux-perf-d8.py:292 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/profiling/ll_prof.py:707

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/profiling/ll_prof.py:707 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/release/common_includes.py:104

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/release/common_includes.py:104 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/run_perf.py:956

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/run_perf.py:956 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/sanitizers/sancov_formatter.py:181

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/sanitizers/sancov_formatter.py:181 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/torque/format-torque.py:168

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/torque/format-torque.py:168 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/try_perf.py:101

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/try_perf.py:101 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in deps/v8/tools/v8_presubmit.py:550

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

deps/v8/tools/v8_presubmit.py:550 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in tools/gyp/pylib/gyp/common.py:449

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

tools/gyp/pylib/gyp/common.py:449 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in tools/gyp/pylib/gyp/input.py:900

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

tools/gyp/pylib/gyp/input.py:900 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in tools/gyp/pylib/gyp/msvs_emulation.py:1190

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

tools/gyp/pylib/gyp/msvs_emulation.py:1190 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in tools/gyp/pylib/gyp/win_tool.py:251

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

tools/gyp/pylib/gyp/win_tool.py:251 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in tools/v8/fetch_deps.py:62

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

tools/v8/fetch_deps.py:62 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'subprocess_shell_true' in tools/v8/node_common.py:33

Found a known-risky pattern (subprocess_shell_true). Review and replace if possible.

tools/v8/node_common.py:33 owaspsubprocess_shell_true

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in benchmark/crypto/rsa-sign-verify-throughput.js:21

Found a known-risky pattern (weak_hash). Review and replace if possible.

benchmark/crypto/rsa-sign-verify-throughput.js:21 owaspweak_hash

medium 9-layer security owasp conf 1.00 Insecure pattern 'weak_hash' in typings/internalBinding/constants.d.ts:244

Found a known-risky pattern (weak_hash). Review and replace if possible.

typings/internalBinding/constants.d.ts:244 owaspweak_hash

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — configure.py:1456

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/libffi/preprocess_asm.py:91

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/uv/tools/make_dist_html.py:115

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/.ycm_extra_conf.py:125

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/third_party/abseil-cpp/absl/abseil.podspec.gen.py:101

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/third_party/abseil-cpp/generate_def_files.py:92

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/third_party/abseil-cpp/roll_abseil.py:32

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/third_party/inspector_protocol/roll.py:64

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/third_party/ittapi/buildall.py:90

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/adb-d8.py:68

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/android-run.py:55

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/avg.py:234

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/builtins-pgo/generate.py:50

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/builtins-pgo/profile_only.py:80

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/callstats.py:72

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/clusterfuzz/foozzie/v8_foozzie_test.py:509

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/clusterfuzz/js_fuzzer/foozzie_launcher.py:46

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/dev/clean-up-feature-flags-in-tests.py:61

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/dev/gen-static-roots.py:98

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/dev/gm.py:229

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/dev/setup-reclient.py:39

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/disasm.py:78

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/dump-cpp.py:57

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/find-commit-for-patch.py:54

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/gcmole/gcmole.py:120

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/gcmole/run-gcmole.py:50

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/gen-keywords-gen-h.py:27

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/generate-builtins-tests.py:117

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/generate-runtime-call-stats.py:222

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/locs.py:413

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/mb/mb.py:1244

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/memory/rss.py:56

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/profiling/linux-perf-chrome.py:322

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/profiling/linux-perf-d8.py:235

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/release/list_deprecated.py:34

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/run-clang-tidy.py:62

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/run.py:24

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/run_perf.py:302

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/sanitizers/sancov_formatter.py:169

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/sanitizers/sancov_merger.py:70

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/testrunner/local/command.py:157

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/testrunner/local/utils.py:107

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/testrunner/outproc/filecheck.py:28

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/try_perf.py:100

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — deps/v8/tools/v8_presubmit.py:549

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/generate_config_gypi.py:32

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/gyp/generator/eclipse.py:101

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/gyp/generator/msvs.py:116

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/gyp/generator/ninja.py:2898

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/gyp/mac_tool.py:271

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/gyp/msvs_emulation.py:139

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/gyp/MSVSVersion.py:182

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/gyp/win_tool.py:133

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/gyp/xcode_emulation.py:1223

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/packaging/_musllinux.py:50

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/gyp/pylib/packaging/tags.py:388

`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/inspector_protocol/roll.py:34

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/run-valgrind.py:59

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/test.py:720

`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/v8/fetch_deps.py:61

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

medium 9-layer quality integrity conf 1.00 Network/subprocess call without timeout or try/except — tools/v8/node_common.py:35

`subprocess.check_output(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.

integrityfragile-runtimerobustness

Complete repo analysis