insecure-tree report

Project: /home/runner/work/insecure_tree/insecure_tree
Source: pipdeptree
Scanned: 2026-10-13T00:09:17.497052+00:00
insecure-tree: 0.3.0 zizmor: 1.30.1

Summary

209

packages

205

with GitHub

197

scanned

145

with findings

1851

errors

904

warnings

Packages

Filter: errors warnings notes clean

Package ↕	Repository ↕	Status ↕	Confidence ↕	Findings
`aiohappyeyeballs==2.7.1`	aio-libs/aiohappyeyeballs	scanned	high	24 errors 6 warnings 6 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:60` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:92` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:126` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:172` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:215` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:44` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:88` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:113` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:34` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:62` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:68` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:92` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:94` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:100` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:108` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:126` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:133` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:138` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:172` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:179` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:186` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:207` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:213` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:215` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:221` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/issue-manager.yml:18` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/issue-manager.yml:3` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/issue-manager.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`aiohttp==3.14.4`	aio-libs/aiohttp	scanned	high	68 errors 1 warning 17 notes zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/agent-scan.yml:3` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/agent-scan.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/auto-merge.yml:2` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/auto-merge.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/bot-conditions: zizmor/bot-conditions `.github/workflows/auto-merge.yml:11` spoofable bot actor check: actor context may be spoofable View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:61` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:101` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:143` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:499` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:578` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:765` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:311` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:311` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:462` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:462` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:62` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:81` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:102` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:106` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:112` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:130` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:144` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:148` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:182` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:188` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:193` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:197` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:292` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:302` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:342` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:356` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:379` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:388` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:395` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:443` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:453` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:476` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:483` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:500` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:502` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:508` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:514` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:557` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:579` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:584` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:593` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:614` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:636` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:640` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:766` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:773` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:804` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:818` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:825` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:835` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:66` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:73` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `package-manager-cache` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:197` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:302` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:388` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:453` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:514` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:660` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/ci-cd.yml:835` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:664` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql.yml:28` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/dependency-submission.yml:25` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/dependency-submission.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/dependency-submission.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/label-remove.yml:2` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/label-remove.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/label-remove.yml:23` action functionality is already included by the runner: use `gh issue edit --remove-label` or `gh pr edit --remove-label` in a script step View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/labels.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/labels.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/reusable-cibuildwheel.yml:92` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:103` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:110` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:119` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:133` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/stale.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`aiosignal==1.4.0`	aio-libs/aiosignal	scanned	medium	15 errors 6 warnings 7 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:91` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unsound-ternary: zizmor/unsound-ternary `.github/workflows/ci-cd.yml:242` unsound pseudo-ternary expression: pseudo-ternary has falsy true value View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:55` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:121` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:141` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:231` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:309` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:92` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:318` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:342` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:352` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:365` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:368` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:378` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:142` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:232` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/ci-cd.yml:378` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:97` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql.yml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:30` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/dependabot-auto-merge.yml:2` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/dependabot-auto-merge.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/bot-conditions: zizmor/bot-conditions `.github/workflows/dependabot-auto-merge.yml:11` spoofable bot actor check: actor context may be spoofable View on GitHub
`annotated-doc==0.0.5`	fastapi/annotated-doc	scanned	high	clean
`annotated-types==0.8.0`	annotated-types/annotated-types	scanned	high	10 errors 6 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:51` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:75` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:47` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:59` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:75` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:81` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:78` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub
`anyio==4.15.1`	agronholm/anyio	scanned	high	37 errors 14 warnings 13 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:65` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:54` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:65` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:67` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:70` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/publish.yml:70` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:43` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-downstream.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-downstream.yml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-downstream.yml:66` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-downstream.yml:97` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-downstream.yml:125` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-downstream.yml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-downstream.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-downstream.yml:32` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-downstream.yml:56` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-downstream.yml:89` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-downstream.yml:116` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test-downstream.yml:26` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test-downstream.yml:50` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test-downstream.yml:83` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test-downstream.yml:112` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test-downstream.yml:136` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-downstream.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-downstream.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-downstream.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-downstream.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-downstream.yml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-downstream.yml:97` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-downstream.yml:101` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-downstream.yml:125` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:49` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:103` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:156` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:40` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:63` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:145` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:168` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:54` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:103` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:105` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:140` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:156` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:158` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:174` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unsound-condition: zizmor/unsound-condition `.github/workflows/test.yml:43` unsound conditional expression: condition always evaluates to true View on GitHub zizmor/unsound-condition: zizmor/unsound-condition `.github/workflows/test.yml:95` unsound conditional expression: condition always evaluates to true View on GitHub zizmor/unsound-condition: zizmor/unsound-condition `.github/workflows/test.yml:148` unsound conditional expression: condition always evaluates to true View on GitHub
`ast_serialize==0.12.1`	mypyc/ast_serialize	scanned	high	36 errors 6 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:38` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:87` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:133` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:172` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:209` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:246` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:64` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:87` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:92` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:106` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:113` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:133` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:134` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:139` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:145` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:151` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:157` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:172` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:173` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:177` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:183` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:189` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:195` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:209` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:210` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:222` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:227` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:238` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:246` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:248` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:253` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:266` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:272` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`astroid==4.3.4`	pylint-dev/astroid	scanned	high	47 errors 8 warnings 10 notes zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/backport.yml:2` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/changelog.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/changelog.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:27` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:92` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:140` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:185` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:219` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:22` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:81` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:126` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:175` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:213` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:95` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:144` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:144` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:224` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:229` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:229` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:229` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql-analysis.yml:48` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:64` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codspeed-walltime.yaml:35` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed-walltime.yaml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed-walltime.yaml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed-walltime.yaml:56` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codspeed.yaml:35` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yaml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yaml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yaml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/label_skip_news.yaml:3` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/label_skip_news.yaml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/linkcheck.yaml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/linkcheck.yaml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/linkcheck.yaml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/linkcheck.yaml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:59` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:70` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-pylint.yml:7` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-pylint.yml:8` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`attrs==26.1.0`	python-attrs/attrs	scanned	high	clean
`bandit==1.9.4`	PyCQA/bandit	scanned	high	14 errors 5 warnings 7 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/build-publish-image.yml:28` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/build-publish-image.yml:29` action's hash pin has mismatched or missing version comment: tag points to commit d23441a48e51 View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/dependency-review.yml:11` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/dependency-review.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/dependency-review.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish-to-pypi.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish-to-test-pypi.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-test-pypi.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-test-pypi.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-test-pypi.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pythonpackage.yml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pythonpackage.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pythonpackage.yml:60` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pythonpackage.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pythonpackage.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pythonpackage.yml:25` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pythonpackage.yml:46` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:61` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`black==26.10.1`	psf/black	scanned	high	1 error zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/diff_shades_comment.yml:3` use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely View on GitHub
`blessed==1.50.0`	jquast/blessed	scanned	high	7 errors 3 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/codspeed.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:83` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:83` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:96` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/tests.yml:18` unpinned image references: container image may be unpinned View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/tests.yml:18` unpinned image references: container image may be unpinned View on GitHub
`boolean.py==5.0`	bastikr/boolean.py	scanned	medium	13 errors 12 warnings 2 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/pypi-release.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pypi-release.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pypi-release.yml:18` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pypi-release.yml:45` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pypi-release.yml:65` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/pypi-release.yml:80` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi-release.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi-release.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi-release.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi-release.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi-release.yml:59` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi-release.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi-release.yml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/pypi-release.yml:59` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-and-build.yml:35` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-and-build.yml:70` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-and-build.yml:83` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-and-build.yml:25` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-and-build.yml:30` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-and-build.yml:51` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-and-build.yml:78` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-and-build.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-and-build.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-and-build.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-and-build.yml:70` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-and-build.yml:83` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-and-build.yml:94` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`build==1.6.1`	pypa/build	scanned	high	clean
`CacheControl==0.14.4`	psf/cachecontrol	scanned	high	clean
`cachetools==7.2.1`	tkem/cachetools	scanned	high	1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub
`cattrs==26.2.1`	python-attrs/cattrs	scanned	high	2 warnings zizmor/unpinned-tools: zizmor/unpinned-tools `.github/workflows/main.yml:27` action installs an unpinned external tool: omitting `just-version` implicitly selects an unpinned tool version View on GitHub zizmor/unpinned-tools: zizmor/unpinned-tools `.github/workflows/main.yml:92` action installs an unpinned external tool: omitting `just-version` implicitly selects an unpinned tool version View on GitHub
`certifi==2026.7.22`	certifi/python-certifi	scanned	high	4 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/bump.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:39` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:18` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub
`cffi==2.1.1`	python-cffi/cffi	scanned	high	25 errors 19 warnings 16 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:36` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:67` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:231` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:322` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:417` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:537` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:560` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:586` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:30` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:62` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:155` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:226` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:258` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:317` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:358` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:412` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:434` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:521` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:532` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:548` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:578` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:598` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:210` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:211` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:283` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:303` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:397` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:466` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:507` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:67` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:165` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:170` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:219` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:231` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:271` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:276` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:310` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:322` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:368` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:373` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:405` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:417` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:444` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:449` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:514` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:526` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:537` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:561` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:564` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:586` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:604` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:70` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:234` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:325` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:420` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:540` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`cfgv==3.5.0`	asottile/cfgv	scanned	medium	1 error 1 warning zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`charset-normalizer==3.5.2`	jawah/charset_normalizer	scanned	high	4 warnings 1 note zizmor/self-repository: zizmor/self-repository `.github/workflows/cd.yml:17` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/codeql.yml:47` action's hash pin has mismatched or missing version comment: tag points to commit 51f77329afa6 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/codeql.yml:54` action's hash pin has mismatched or missing version comment: tag points to commit 51f77329afa6 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/codeql.yml:57` action's hash pin has mismatched or missing version comment: tag points to commit 51f77329afa6 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/scorecards.yml:69` action's hash pin has mismatched or missing version comment: tag points to commit 51f77329afa6 View on GitHub
`click==8.5.0`	pallets/click	scanned	high	clean
`cloudpickle==3.1.2`	cloudpipe/cloudpickle	scanned	medium	22 errors 16 warnings zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish_to_pypi.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish_to_pypi.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:118` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish_to_pypi.yml:123` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/testing.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/testing.yml:51` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/testing.yml:92` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/testing.yml:128` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/testing.yml:156` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/testing.yml:181` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/testing.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/testing.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/testing.yml:28` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/testing.yml:81` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/testing.yml:117` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/testing.yml:145` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/testing.yml:172` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/ref-confusion: zizmor/ref-confusion `.github/workflows/testing.yml:76` git ref for action with ambiguous ref type: uses a ref that's provided by both the branch and tag namespaces View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:92` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:94` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:128` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:130` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:156` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:158` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:181` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/testing.yml:183` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`codespell==2.4.3`	codespell-project/codespell	scanned	high	14 errors 1 note zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/autofix.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codespell.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codespell.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/release.yml:55` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:91` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:98` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`colorama==0.4.6`	tartley/colorama	scanned	high	5 errors 4 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/lint_python.yml:7` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/lint_python.yml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/lint_python.yml:7` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/lint_python.yml:8` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`colorlog==6.12.0`	borntyping/python-colorlog	scanned	medium	7 errors 6 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:44` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:68` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:27` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:68` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:70` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`coverage==7.16.2`	coveragepy/coveragepy	scanned	medium	clean
`crosshair-tool==0.0.111`	pschanely/CrossHair	scanned	high	18 errors 14 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/build_documentation.yml:18` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_documentation.yml:15` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_documentation.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_documentation.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_documentation.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:52` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_wheels.yml:77` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_wheels.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_wheels.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_wheels.yml:47` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_wheels.yml:73` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:68` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:104` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_wheels.yml:109` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test_crosshair.yml:64` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test_crosshair.yml:19` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test_crosshair.yml:64` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test_crosshair.yml:67` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test_hypothesis_integration.yml:14` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test_hypothesis_integration.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test_hypothesis_integration.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test_hypothesis_integration.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test_hypothesis_integration.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test_hypothesis_integration.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`cryptography==50.0.2`	pyca/cryptography	scanned	high	4 errors 22 notes zizmor/self-repository: zizmor/self-repository `.github/workflows/benchmark.yml:43` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/ci.yml:144` unpinned image references: container image is unpinned View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/ci.yml:203` unpinned image references: container image is unpinned View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:99` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:103` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:110` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:140` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:172` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:178` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:198` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:234` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:240` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:260` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:290` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:306` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:316` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:333` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:358` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:365` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:439` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/linkcheck.yml:35` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/pypi-publish.yml:3` use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/wheel-builder.yml:66` unpinned image references: container image is unpinned View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/wheel-builder.yml:173` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/wheel-builder.yml:252` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/wheel-builder.yml:304` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`cyclonedx-python-lib==11.12.0`	CycloneDX/cyclonedx-python-lib	scanned	high	clean
`deadcode==2.4.1`	albertas/deadcode	scanned	high	2 errors 1 warning zizmor/artipacked: zizmor/artipacked `.github/workflows/check-deadcode-on-python310.yml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check-deadcode-on-python310.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check-deadcode-on-python310.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`defusedxml==0.7.1`	tiran/defusedxml	scanned	medium	11 errors 3 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:45` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:60` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:61` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pypi.yml:38` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:93` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:98` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`deptry==0.25.1`	osprey-oss/deptry	scanned	high	clean
`dill==0.4.1`	uqfoundation/dill	no workflows	high	-
`distlib==0.4.3`	pypa/distlib	scanned	high	3 errors 2 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/package-tests.yml:42` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/package-tests.yml:23` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/package-tests.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/package-tests.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/package-tests.yml:64` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`distro==1.9.0`	python-distro/distro	scanned	medium	10 errors 7 warnings 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:51` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:74` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:26` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:69` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/ref-confusion: zizmor/ref-confusion `.github/workflows/ci.yaml:65` git ref for action with ambiguous ref type: uses a ref that's provided by both the branch and tag namespaces View on GitHub zizmor/ref-confusion: zizmor/ref-confusion `.github/workflows/ci.yaml:76` git ref for action with ambiguous ref type: uses a ref that's provided by both the branch and tag namespaces View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:54` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:65` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:74` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/deploy.yml:27` prefer trusted publishing for authentication: this command View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`docstring_parser_fork==0.0.16`	rr-/docstring_parser	scanned	high	13 errors 5 warnings 4 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/apidocs.yml:10` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/apidocs.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/apidocs.yml:10` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/apidocs.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/apidocs.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:38` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:47` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:35` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:44` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:48` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:70` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:75` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`editor==2.0.1`	rec/editor	scanned	high	1 error zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release-tests.yml:25` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub
`execnet==2.1.2`	pytest-dev/execnet	scanned	low	13 errors 5 warnings 4 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:33` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:48` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:48` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:49` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:20` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:27` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`filelock==4.1.0`	tox-dev/py-filelock	zizmor_failed	high	-
`frozenlist==1.8.0`	aio-libs/frozenlist	scanned	medium	35 errors 9 warnings 17 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:76` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:3` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:46` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:64` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:124` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:127` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:194` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:400` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:412` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:424` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:102` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:106` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:322` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:111` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:249` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:256` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:264` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:274` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:279` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:364` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:388` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:408` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:528` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:536` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:569` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:583` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:590` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:600` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:129` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:426` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/ci-cd.yml:600` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:86` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:125` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:156` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:272` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:468` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/dependabot-auto-merge.yml:4` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/dependabot-auto-merge.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/bot-conditions: zizmor/bot-conditions `.github/workflows/dependabot-auto-merge.yml:14` spoofable bot actor check: actor context may be spoofable View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/reusable-cibuildwheel.yml:88` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:106` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:111` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:124` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/reusable-linters.yml:29` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unsound-ternary: zizmor/unsound-ternary `.github/workflows/reusable-linters.yml:69` unsound pseudo-ternary expression: pseudo-ternary has falsy true value View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:30` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:56` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/reusable-linters.yml:39` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`gha-update==0.2.0`	davidism/gha-update	scanned	high	2 errors 7 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/pre-commit.yaml:10` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pre-commit.yaml:7` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yaml:9` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yaml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/publish.yaml:32` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/known-vulnerable-actions: zizmor/known-vulnerable-actions `.github/workflows/publish.yaml:45` action has a known vulnerability: GHSA-vxmw-7h4f-hqxh View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/publish.yaml:10` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:23` overly broad permissions: default permissions used due to no permissions: block View on GitHub
`ghp-import==2.1.0`	c-w/ghp-import	scanned	medium	6 errors 7 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/cd.yaml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/cd.yaml:27` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/cd.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/cd.yaml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/cd.yaml:22` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cd.yaml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cd.yaml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cd.yaml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cd.yaml:28` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`git2md==1.1.7`	xpos587/git2md	scanned	medium	13 errors 9 warnings 4 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yaml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yaml:72` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yaml:122` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yaml:147` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yaml:15` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yaml:42` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yaml:68` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yaml:140` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/release.yaml:27` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/release.yaml:59` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/release.yaml:81` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/release.yaml:138` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/release.yaml:138` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:75` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:92` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:107` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:113` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:123` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:128` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:147` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:150` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yaml:155` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/release.yaml:145` unpinned image references: container image uses the floating 'latest' tag View on GitHub
`google-re2==1.1.20251105`	google/re2	scanned	medium	34 errors 14 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-bazel.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-bazel.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-bazel.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-bazel.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cmake.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cmake.yml:34` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cmake.yml:49` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cmake.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cmake.yml:34` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cmake.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:45` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:72` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pages.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pages.yml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/pages.yml:10` unpinned image references: container image is unpinned View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python.yml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python.yml:101` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python.yml:163` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python.yml:220` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:101` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:105` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:108` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:137` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:163` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:167` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:175` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:204` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:220` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:224` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:240` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:256` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/python.yml:19` unpinned image references: container image is unpinned View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release-bazel.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/release.yml:42` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`griffe==2.3.2`	mkdocstrings/griffe	scanned	high	clean
`griffecli==2.3.2`	-	no repo	-	-
`griffelib==2.3.2`	-	no repo	-	-
`grimp==3.17`	python-grimp/grimp	scanned	medium	41 errors 15 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:47` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:66` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:35` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:63` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-tools: zizmor/unpinned-tools `.github/workflows/main.yml:19` action installs an unpinned external tool: omitting `just-version` implicitly selects an unpinned tool version View on GitHub zizmor/unpinned-tools: zizmor/unpinned-tools `.github/workflows/main.yml:50` action installs an unpinned external tool: omitting `just-version` implicitly selects an unpinned tool version View on GitHub zizmor/unpinned-tools: zizmor/unpinned-tools `.github/workflows/main.yml:69` action installs an unpinned external tool: omitting `just-version` implicitly selects an unpinned tool version View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:36` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:76` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:121` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:164` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:211` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:90` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:97` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:121` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:124` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:130` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:136` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:142` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:149` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:164` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:165` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:176` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:189` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:196` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:203` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:211` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:213` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:218` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:229` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:231` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:50` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:90` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:130` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:142` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:176` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:196` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub
`h11==0.16.0`	python-hyper/h11	scanned	medium	3 errors 2 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`h2==4.4.1`	python-hyper/h2	scanned	high	3 errors 1 warning 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`hpack==4.2.0`	python-hyper/hpack	scanned	high	3 errors 1 warning 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`httpcore==1.0.9`	encode/httpcore	scanned	high	4 errors 4 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-suite.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-suite.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-suite.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-suite.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`httpcore2==2.13.1`	pydantic/httpx2	scanned	high	1 error zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/benchmark.yml:10` overly broad permissions: id-token: write is overly broad at the workflow level View on GitHub
`httpx==0.28.1`	encode/httpx	scanned	high	4 errors 4 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-suite.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test-suite.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-suite.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-suite.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`httpx2==2.13.1`	pydantic/httpx2	scanned	high	1 error zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/benchmark.yml:10` overly broad permissions: id-token: write is overly broad at the workflow level View on GitHub
`hyperframe==6.1.0`	python-hyper/hyperframe	scanned	high	3 errors 1 warning 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`hypothesis==6.168.5`	HypothesisWorks/hypothesis	scanned	high	clean
`identify==2.6.20`	pre-commit/identify	scanned	medium	1 error 1 warning zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`idna==3.20`	kjd/idna	scanned	high	2 errors 6 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:84` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:112` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:124` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python-package.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python-package.yml:43` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python-package.yml:85` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/unicode-check.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub
`import-linter==2.15`	seddonym/import-linter	scanned	medium	15 errors 13 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:66` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:85` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:30` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:56` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:80` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:85` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:91` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-tools: zizmor/unpinned-tools `.github/workflows/main.yml:20` action installs an unpinned external tool: omitting `just-version` implicitly selects an unpinned tool version View on GitHub zizmor/unpinned-tools: zizmor/unpinned-tools `.github/workflows/main.yml:43` action installs an unpinned external tool: omitting `just-version` implicitly selects an unpinned tool version View on GitHub zizmor/unpinned-tools: zizmor/unpinned-tools `.github/workflows/main.yml:88` action installs an unpinned external tool: omitting `just-version` implicitly selects an unpinned tool version View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:18` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/release.yml:25` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:20` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub
`iniconfig==2.3.1`	pytest-dev/iniconfig	scanned	high	11 errors 5 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:42` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:28` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test.yml:68` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:83` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:93` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:111` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:117` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:136` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:142` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/test.yml:93` action functionality is already included by the runner: use `gh release` in a script step View on GitHub
`inquirer==3.4.1`	magmax/python-inquirer	scanned	high	18 errors 11 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/documentation.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/documentation.yml:19` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/documentation.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/documentation.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/documentation.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/labeler.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/labeler.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/labeler.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/labeler.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:14` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/release.yml:60` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:34` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:106` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:102` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:82` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:96` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:107` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:110` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:132` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:146` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`insecure_tree==0.3.0`	matthewdeanmartin/insecure_tree	scanned	high	clean
`installer==1.0.1`	pypa/installer	scanned	high	clean
`interrogate==1.7.0`	econchick/interrogate	scanned	high	32 errors 24 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:39` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:78` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:114` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:127` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:146` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:20` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:31` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:73` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:109` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:120` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:142` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:157` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:67` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:103` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:114` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:118` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:127` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:128` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:146` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:147` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:171` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pypi.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pypi.yml:16` overly broad permissions: id-token: write is overly broad at the workflow level View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:28` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pypi.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/sanity.yml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/sanity.yml:47` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/sanity.yml:62` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/sanity.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/sanity.yml:19` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/sanity.yml:43` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/sanity.yml:58` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sanity.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sanity.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sanity.yml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sanity.yml:48` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sanity.yml:62` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sanity.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/windows.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/windows.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/windows.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/windows.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`isort==9.0.2`	PyCQA/isort	scanned	high	23 errors 2 warnings 6 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:78` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:56` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:87` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:89` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/continuous-integration.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/continuous-integration.yml:62` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/continuous-integration.yml:92` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:65` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/continuous-integration.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/release.yml:11` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`jaraco.classes==3.4.0`	jaraco/jaraco.classes	scanned	medium	7 errors 3 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:57` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:84` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:120` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:107` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:122` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`jaraco.context==6.1.2`	jaraco/jaraco.context	scanned	high	7 errors 3 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:60` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:87` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:123` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:87` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:91` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:110` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:123` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:125` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`jaraco.functools==4.6.0`	jaraco/jaraco.functools	scanned	high	7 errors 3 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:60` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:87` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:123` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:87` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:91` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:110` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:123` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:125` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`jeepney==0.9.0`	-	no repo	-	-
`jiggle_version==2.2.1`	matthewdeanmartin/jiggle_version	scanned	low	clean
`Jinja2==3.1.6`	pallets/jinja	scanned	high	2 errors 10 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/pre-commit.yaml:10` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pre-commit.yaml:7` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yaml:9` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yaml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/publish.yaml:32` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/known-vulnerable-actions: zizmor/known-vulnerable-actions `.github/workflows/publish.yaml:45` action has a known vulnerability: GHSA-vxmw-7h4f-hqxh View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/publish.yaml:10` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:36` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:33` overly broad permissions: default permissions used due to no permissions: block View on GitHub
`jinxed==2.1.0`	Rockhopper-Technologies/jinxed	scanned	medium	3 errors 1 warning 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:65` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:65` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:81` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/tests.yml:15` unpinned image references: container image may be unpinned View on GitHub
`jiter==0.17.0`	pydantic/jiter	scanned	low	1 note zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/ci.yml:793` prefer trusted publishing for authentication: this command View on GitHub
`joblib==1.6.0`	joblib/joblib	scanned	high	21 errors 2 warnings 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/codespell.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codespell.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codespell.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codespell.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish-to-pypi.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish-to-pypi.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish-to-pypi.yml:117` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:41` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:57` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:140` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:183` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:70` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:141` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:144` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:156` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:171` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:184` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:187` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`jsonschema==4.26.0`	python-jsonschema/jsonschema	scanned	high	clean
`jsonschema-specifications==2025.9.1`	python-jsonschema/jsonschema-specifications	scanned	high	12 errors 4 warnings 3 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:43` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:82` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:32` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:68` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:98` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:82` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:93` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:23` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:63` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:84` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub
`keepachangelog-manager-fork==6.9.0`	matthewdeanmartin/keepachangelog-manager	scanned	high	clean
`keyring==25.7.0`	jaraco/keyring	scanned	high	7 errors 3 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:57` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:84` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:120` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:107` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:122` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`librt==0.16.0`	mypyc/librt	scanned	high	9 errors 6 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/buildwheels.yml:88` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/buildwheels.yml:119` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/buildwheels.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/buildwheels.yml:15` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/buildwheels.yml:76` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/buildwheels.yml:115` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:96` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:101` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:109` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:119` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:130` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:143` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/buildwheels.yml:149` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`license-expression==30.4.4`	aboutcode-org/license-expression	scanned	medium	1 note zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/pypi-release.yml:69` action functionality is already included by the runner: use `gh release` in a script step View on GitHub
`linkcheckmd==1.4.0`	scivision/linkchecker-markdown	scanned	medium	4 errors 3 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codespell.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codespell.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codespell.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`llvm-diagnostics==3.0.1`	tomtom-international/llvm-diagnostics	scanned	medium	11 errors 12 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/build_and_test.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_and_test.yml:36` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_and_test.yml:57` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build_and_test.yml:78` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_and_test.yml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_and_test.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_and_test.yml:32` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_and_test.yml:53` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build_and_test.yml:74` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_and_test.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_and_test.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_and_test.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_and_test.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_and_test.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_and_test.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_and_test.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build_and_test.yml:81` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/quality_checks.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/quality_checks.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/release.yml:34` prefer trusted publishing for authentication: this command View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`loguru==0.7.3`	Delgan/loguru	scanned	high	19 errors 7 warnings 6 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql-analysis.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/docs.yml:10` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/docs.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/docs.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/docs.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/lint.yml:10` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/lint.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/lint.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/lint.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/packaging.yml:10` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/packaging.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/packaging.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/packaging.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/packaging.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/packaging.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/packaging.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/packaging.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:51` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:76` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:72` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:67` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:81` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`lsprotocol==2025.0.0`	microsoft/lsprotocol	scanned	high	59 errors 33 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql-analysis.yml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:56` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql-analysis.yml:70` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/dep-bot-auto-merge.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/bot-conditions: zizmor/bot-conditions `.github/workflows/dep-bot-auto-merge.yml:11` spoofable bot actor check: actor context may be spoofable View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/issue-labels.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pr-check.yml:11` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pr-check.yml:49` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pr-check.yml:102` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pr-check.yml:122` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pr-check.yml:146` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pr-check.yml:177` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pr-check.yml:213` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-check.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-check.yml:7` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-check.yml:45` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-check.yml:92` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-check.yml:118` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-check.yml:138` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-check.yml:169` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-check.yml:209` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:74` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:103` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:106` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:123` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:126` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:147` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:150` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:155` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:178` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:181` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:186` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:214` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:217` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-check.yml:232` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pr-labels.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pr-labels.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/push-check.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/push-check.yml:54` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/push-check.yml:107` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/push-check.yml:131` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/push-check.yml:162` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/push-check.yml:194` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/push-check.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/push-check.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/push-check.yml:50` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/push-check.yml:97` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/push-check.yml:123` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/push-check.yml:154` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/push-check.yml:190` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:89` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:108` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:111` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:132` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:135` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:140` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:163` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:166` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:171` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:195` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:198` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push-check.yml:213` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/push-check.yml:25` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/push-check.yml:63` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/push-check.yml:79` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `cache` enables caching View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/updater.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/updater.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/updater.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/version-check.yml:11` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/version-check.yml:7` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/version-check.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/version-check.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`maison==2.0.2`	dbatten/maison	github_api_failed	high	-
`Markdown==3.11`	Python-Markdown/markdown	scanned	high	25 errors 23 warnings 3 notes zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/changelog-enforcer.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/changelog-enforcer.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/changelog-validator.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/changelog-validator.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/changelog-validator.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/changelog-validator.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/changelog-validator.yml:25` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/changelog-validator.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/changelog-validator.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/changelog-validator.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/changelog-validator.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/changelog-validator.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:55` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:59` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:52` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/deploy.yml:26` prefer trusted publishing for authentication: this step View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:32` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/known-vulnerable-actions: zizmor/known-vulnerable-actions `.github/workflows/deploy.yml:26` action has a known vulnerability: GHSA-vxmw-7h4f-hqxh View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:56` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/deploy.yml:42` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/manual_deploy.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/manual_deploy.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/manual_deploy.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/manual_deploy.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/manual_deploy.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/manual_deploy.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tox.yml:43` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tox.yml:76` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tox.yml:3` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tox.yml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tox.yml:64` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/ref-confusion: zizmor/ref-confusion `.github/workflows/tox.yml:57` git ref for action with ambiguous ref type: uses a ref that's provided by both the branch and tag namespaces View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/version_check.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/version_check.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/version_check.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/version_check.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`markdown-it-py==4.2.0`	executablebooks/markdown-it-py	scanned	high	23 errors 8 warnings 7 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/benchmark.yml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/benchmark.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/benchmark.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/benchmark.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/benchmark.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/benchmark.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/copilot-setup-steps.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/copilot-setup-steps.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/copilot-setup-steps.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/fuzz.yml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/fuzz.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/fuzz.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/fuzz.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:38` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:72` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:92` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:126` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:17` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:29` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:65` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:88` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:134` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:74` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:92` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:95` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:108` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:126` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:127` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:132` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`MarkupSafe==3.0.4`	pallets/markupsafe	scanned	high	clean
`mccabe==0.7.0`	pycqa/mccabe	no workflows	medium	-
`mdformat==1.0.0`	hukkin/mdformat	scanned	high	10 errors 11 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:41` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:71` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:74` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:99` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:32` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:63` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:85` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:93` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/tests.yaml:112` prefer trusted publishing for authentication: this command View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:68` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:71` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:74` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:100` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`mdurl==0.1.2`	executablebooks/mdurl	scanned	high	7 errors 8 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:76` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:31` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:62` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:70` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/tests.yaml:89` prefer trusted publishing for authentication: this command View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`mergedeep==1.3.4`	clarketm/mergedeep	no workflows	medium	-
`metametameta==0.1.14`	matthewdeanmartin/metametameta	scanned	low	clean
`mkdocs==1.6.1`	mkdocs/mkdocs	scanned	high	16 errors 13 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/autofix.yml:9` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/autofix.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/autofix.yml:9` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/autofix.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/autofix.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:58` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:89` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:55` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:86` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/ref-confusion: zizmor/ref-confusion `.github/workflows/ci.yml:48` git ref for action with ambiguous ref type: uses a ref that's provided by both the branch and tag namespaces View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:48` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:67` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:89` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:91` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy-release.yml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy-release.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy-release.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy-release.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/docs.yml:11` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/docs.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/docs.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/docs.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`mkdocs-autorefs==1.4.4`	mkdocstrings/autorefs	scanned	high	clean
`mkdocs-get-deps==0.2.2`	mkdocs/get-deps	scanned	high	10 errors 8 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/autofix.yml:9` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/autofix.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/autofix.yml:10` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/autofix.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/autofix.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:33` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:55` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:52` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:34` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:56` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy-release.yml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy-release.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy-release.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy-release.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`mkdocstrings==1.0.7`	mkdocstrings/mkdocstrings	scanned	high	clean
`mkdocstrings-python==2.0.9`	mkdocstrings/python	scanned	high	15 errors 7 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:50` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:119` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:29` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:89` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:62` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:83` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:126` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:132` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:144` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:22` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/release.yml:26` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/sponsors.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sponsors.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sponsors.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`more-itertools==11.1.0`	more-itertools/more-itertools	scanned	high	3 errors 1 warning 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/python-app.yml:14` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/python-app.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-app.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-app.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-app.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`msgpack==1.2.3`	msgpack/msgpack-python	scanned	high	1 error 7 warnings 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/docs.yaml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/docs.yaml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/lint.yaml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/lint.yaml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:28` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test_debug.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test_debug.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wheel.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/wheel.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/wheel.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/wheel.yml:71` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/wheel.yml:33` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub
`multidict==6.9.1`	aio-libs/multidict	scanned	medium	71 errors 18 warnings 21 notes zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/auto-merge.yml:4` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/auto-merge.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/bot-conditions: zizmor/bot-conditions `.github/workflows/auto-merge.yml:14` spoofable bot actor check: actor context may be spoofable View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:74` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:568` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:3` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:44` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:62` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:114` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:117` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:147` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:228` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:448` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:503` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:537` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:598` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:659` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:717` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:811` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:947` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:1005` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:1017` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:1100` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:92` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:96` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:413` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:534` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-cd.yml:535` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:75` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:101` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:280` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:288` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:295` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:331` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:357` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:424` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:445` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:457` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:464` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:470` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:500` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:512` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:520` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:525` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:569` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:572` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:578` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:584` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:607` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:614` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:620` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:646` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:657` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:668` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:675` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:682` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:704` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:715` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:726` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:733` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:739` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:801` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:830` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:838` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:937` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:967` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:971` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:978` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:996` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:1187` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:1195` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:1262` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:1300` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:1307` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:331` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:464` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:572` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:614` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:675` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:733` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:838` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:119` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:149` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:1019` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:1086` obfuscated usage of GitHub Actions features: can be reduced to a constant View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:1102` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:115` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:123` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:193` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:1061` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:1115` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/reusable-cibuildwheel.yml:88` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:106` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:111` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:124` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/reusable-linters.yml:29` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unsound-ternary: zizmor/unsound-ternary `.github/workflows/reusable-linters.yml:63` unsound pseudo-ternary expression: pseudo-ternary has falsy true value View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:30` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-linters.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`mypy==2.4.0`	python/mypy	scanned	high	clean
`mypy_extensions==1.1.0`	python/mypy_extensions	scanned	high	4 errors 2 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:25` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:58` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`nab==0.0.19`	notatallshaw/nab	scanned	high	clean
`nab-index==0.0.19`	notatallshaw/nab	scanned	high	clean
`nab-markersets==0.0.19`	notatallshaw/nab	scanned	high	clean
`nab-project==0.0.19`	notatallshaw/nab	scanned	high	clean
`nab-provider==0.0.19`	notatallshaw/nab	scanned	high	clean
`nab-resolver==0.0.19`	notatallshaw/nab	scanned	high	clean
`nltk==3.10.3`	nltk/nltk	scanned	high	24 errors 15 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/cffconvert.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cffconvert.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cffconvert.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:39` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:55` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:77` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:139` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:411` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:435` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:111` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:231` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:242` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:253` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:262` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:139` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:142` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:217` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:234` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:411` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:435` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:438` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/labeler.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:92` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:93` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:133` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/release.yml:133` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/retest-pr.yml:55` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/retest-pr.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/retest-pr.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/retest-pr.yml:48` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`nodeenv==1.11.0`	ekalinin/nodeenv	scanned	medium	24 errors 18 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:57` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:52` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:28` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:59` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:67` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pages.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:34` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pages.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:44` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:76` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:103` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:129` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:148` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:40` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:71` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:95` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:124` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:145` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:103` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:106` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:129` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:132` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:148` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:151` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:167` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`openai==3.28.0`	openai/openai-python	scanned	high	1 error 2 warnings 4 notes zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/castiron-custom-code-comment.yml:4` use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:80` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:162` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:197` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/detect-breaking-changes.yml:40` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/python-version-review.yml:45` action's hash pin has mismatched or missing version comment: tag points to commit d23441a48e51 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/python-version-review.yml:106` action's hash pin has mismatched or missing version comment: tag points to commit bdf19a4a223e View on GitHub
`orjson==3.13.0`	ijl/orjson	scanned	high	30 errors 11 warnings 12 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:34` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:127` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:207` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:275` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:327` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:388` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:476` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:546` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/artifact.yaml:611` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:18` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:87` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:174` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:240` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:308` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:360` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:447` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/artifact.yaml:522` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:34` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:127` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:157` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:207` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:231` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:275` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:299` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:327` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:329` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:351` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:388` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:390` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:395` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:438` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:476` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:478` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:513` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:546` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:548` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:583` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:611` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:613` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:621` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/artifact.yaml:629` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/artifact.yaml:130` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/lint.yaml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/lint.yaml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/lint.yaml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/lint.yaml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/unusual.yaml:30` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/unusual.yaml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/unusual.yaml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/unusual.yaml:30` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`packageurl-python==0.17.6`	package-url/packageurl-python	scanned	medium	2 warnings zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:38` overly broad permissions: default permissions used due to no permissions: block View on GitHub
`packaging==26.3`	pypa/packaging	scanned	high	2 warnings zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/publish.yml:69` action's hash pin has mismatched or missing version comment: points to unknown ref View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/publish.yml:92` action's hash pin has mismatched or missing version comment: points to unknown ref View on GitHub
`pathspec==1.1.1`	cpburnz/python-pathspec	scanned	high	1 error 4 warnings 6 notes zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish-to-pypi.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish-to-pypi.yaml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/publish-to-pypi.yaml:22` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish-to-testpypi.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish-to-testpypi.yaml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-all.yaml:61` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-all.yaml:95` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-cross.yaml:57` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-cross.yaml:91` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-quick.yaml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-quick.yaml:65` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub
`pip==26.2.1`	pypa/pip	scanned	high	clean
`pip_api==0.0.35`	di/pip-api	scanned	high	17 errors 9 warnings 5 notes zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pip-feed.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pip-feed.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/release.yml:44` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:36` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:69` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:18` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:32` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:62` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:80` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:103` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:123` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test.yml:101` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:71` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:90` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:95` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:110` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:115` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:131` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pip_audit==2.10.1`	pypa/pip-audit	scanned	high	clean
`pip-requirements-parser==32.0.1`	nexB/pip-requirements-parser	zizmor_failed	medium	-
`pipdeptree==4.2.6`	tox-dev/pipdeptree	scanned	high	clean
`platformdirs==4.12.4`	tox-dev/platformdirs	scanned	high	clean
`pluggy==1.6.0`	pytest-dev/pluggy	scanned	low	clean
`pre_commit==4.6.2`	pre-commit/pre-commit	scanned	medium	8 errors 8 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/languages.yaml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/languages.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/languages.yaml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/languages.yaml:30` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/languages.yaml:77` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/languages.yaml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/languages.yaml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/languages.yaml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/languages.yaml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/languages.yaml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/languages.yaml:68` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:19` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`prompt_toolkit==3.0.53`	prompt-toolkit/python-prompt-toolkit	scanned	high	3 errors 1 warning 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yaml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yaml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yaml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yaml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yaml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`propcache==0.5.4`	aio-libs/propcache	scanned	medium	35 errors 11 warnings 11 notes zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/auto-merge.yml:4` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/auto-merge.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/bot-conditions: zizmor/bot-conditions `.github/workflows/auto-merge.yml:14` spoofable bot actor check: actor context may be spoofable View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:92` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:360` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:486` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:3` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:69` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:142` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:161` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:226` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:291` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:315` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:477` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:527` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:542` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:554` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:89` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:93` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:361` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:363` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:370` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:377` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:437` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:465` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:487` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:489` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:496` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:504` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:521` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:538` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:635` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:643` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:676` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:690` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:697` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:707` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:377` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:504` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:162` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:228` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:556` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/ci-cd.yml:707` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:98` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:255` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:599` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/reusable-build-wheel.yml:95` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/reusable-build-wheel.yml:109` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-build-wheel.yml:74` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-build-wheel.yml:81` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-build-wheel.yml:121` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-build-wheel.yml:138` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`py==1.11.0`	pytest-dev/py	scanned	low	5 errors 5 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:50` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:41` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/main.yml:63` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:34` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`py-serializable==2.1.0`	madpah/serializable	scanned	high	22 errors 7 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/python.yml:51` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python.yml:75` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python.yml:109` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python.yml:164` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:56` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:62` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:86` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:111` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:114` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:166` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:171` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:177` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python.yml:194` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:69` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:103` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/release.yml:142` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:71` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:74` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:105` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:111` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:117` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:132` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:142` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:149` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pyclean==3.7.0`	bittner/pyclean	scanned	high	6 errors 3 warnings 3 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/check.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/check.yml:20` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:17` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:20` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pycparser==3.11`	eliben/pycparser	scanned	high	3 errors 1 warning zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:25` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pydantic==2.14.0`	pydantic/pydantic	scanned	high	1 error 2 notes zizmor/github-app: zizmor/github-app `.github/workflows/ci.yml:1038` dangerous use of GitHub App tokens: app token inherits blanket installation permissions View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:252` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/update-pydantic-people.yml:20` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`pydantic_core==2.50.0`	pydantic/pydantic-core	scanned	low	98 errors 36 warnings 4 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:84` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:124` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:153` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:196` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:222` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:227` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:264` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:299` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:318` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:390` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:490` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:541` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:574` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:615` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:670` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:699` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:60` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:114` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:148` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:184` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:217` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:260` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:294` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:315` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:366` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:386` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:404` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:518` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:569` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:600` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:652` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:28` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:54` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:87` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:90` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:95` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:124` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:127` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:130` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:133` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:153` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:156` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:166` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:171` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:196` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:199` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:204` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:207` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:222` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:227` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:232` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:235` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:238` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:264` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:267` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:272` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:275` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:280` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:299` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:302` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:305` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:307` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:318` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:321` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:329` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:331` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:340` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:348` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:360` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:381` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:390` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:391` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:394` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:399` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:490` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:493` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:501` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:513` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:541` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:544` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:550` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:564` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:574` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:577` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:615` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:618` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:624` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:670` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:673` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:676` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:699` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:701` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:707` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:719` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:725` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:24` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:28` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:90` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:95` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:130` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:133` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:156` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:171` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:199` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:207` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:235` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:238` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:272` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:275` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `package-manager-cache` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:280` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:305` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:329` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `lookup-only` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:340` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:348` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `package-manager-cache` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:544` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:673` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:701` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/ci.yml:725` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yml:557` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codspeed.yml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/codspeed.yml:17` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/codspeed.yml:60` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/codspeed.yml:50` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`pydantic-settings==2.15.0`	pydantic/pydantic-settings	scanned	high	clean
`pydoclint==0.11.0`	jsh9/pydoclint	scanned	high	7 errors 6 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/python-package.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python-package.yml:36` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/python-package.yml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/python-package.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/python-package.yml:31` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-package.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-package.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-package.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-package.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python-publish.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/python-publish.yml:32` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-publish.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-publish.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-publish.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pydoctest==0.2.1`	jepperaskdk/pydoctest	scanned	medium	5 errors 4 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/python-package.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/python-package.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-package.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-package.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-package.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/python-publish.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/python-publish.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/python-publish.yml:31` prefer trusted publishing for authentication: this command View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-publish.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/python-publish.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pyenchant==3.3.0`	pyenchant/pyenchant	scanned	high	12 errors 8 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/linters.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/linters.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/linters.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/linters.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:18` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/website.yml:14` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/website.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/website.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/website.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/website.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pygls==2.1.1`	openlawlibrary/pygls	scanned	low	1 warning 1 note zizmor/adhoc-packages: zizmor/adhoc-packages `.github/workflows/json-extension.yml:41` ad-hoc installation of packages: installs a package outside of a lockfile View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub
`Pygments==2.21.0`	pygments/pygments	scanned	high	12 errors 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yaml:29` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yaml:45` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yaml:59` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yaml:78` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yaml:30` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yaml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yaml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yaml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yaml:60` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yaml:61` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yaml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yaml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/build.yaml:32` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/docs.yaml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/docs.yaml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/docs.yaml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/docs.yaml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pylint==4.1.2`	pylint-dev/pylint	scanned	high	4 errors 3 warnings zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/backport.yml:2` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/codeql-analysis.yml:57` action's hash pin has mismatched or missing version comment: tag points to commit 24c54180a607 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/codeql-analysis.yml:68` action's hash pin has mismatched or missing version comment: tag points to commit 24c54180a607 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/codeql-analysis.yml:82` action's hash pin has mismatched or missing version comment: tag points to commit 24c54180a607 View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/label_skip_news.yaml:3` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/primer_comment.yaml:9` use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/pyreverse_primer_comment.yaml:7` use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely View on GitHub
`pymdown-extensions==12.2`	facelessuser/pymdown-extensions	scanned	high	19 errors 6 warnings 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:41` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:76` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:97` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:67` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:88` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:59` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:97` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:103` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/build.yml:103` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `package-manager-cache` enables caching View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:30` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:30` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pyparsing==3.3.3`	pyparsing/pyparsing	scanned	high	5 errors 2 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:35` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/cifuzz.yml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cifuzz.yml:9` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cifuzz.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/cifuzz.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pyphen==0.18.1`	Kozea/Pyphen	scanned	high	7 errors 2 warnings 4 notes zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/doconfly.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/release.yml:40` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:18` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:5` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pyproject-api==1.11.5`	tox-dev/pyproject-api	scanned	high	clean
`pyproject_hooks==1.3.3`	pypa/pyproject-hooks	scanned	high	clean
`pytest==9.1.1`	pytest-dev/pytest	scanned	high	1 warning zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/stale.yml:13` action's hash pin has mismatched or missing version comment: tag points to commit 5f858e3efba3 View on GitHub
`pytest-cov==7.1.0`	pytest-dev/pytest-cov	scanned	medium	6 errors 5 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:226` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:45` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:246` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:226` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:229` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:256` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pytest-mock==3.16.0`	pytest-dev/pytest-mock	scanned	high	16 errors 2 warnings 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:41` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:58` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:58` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:59` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:80` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:62` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/deploy.yml:73` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:55` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:31` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:64` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pytest-randomly==5.0.0`	pytest-dev/pytest-randomly	scanned	high	2 errors 3 warnings zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:55` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/main.yml:40` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/main.yml:74` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub
`pytest-sugar==1.1.1`	Teemu/pytest-sugar	scanned	medium	4 errors 2 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/build-and-test.yaml:27` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build-and-test.yaml:58` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build-and-test.yaml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build-and-test.yaml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build-and-test.yaml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build-and-test.yaml:61` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pytest-timeout==2.4.0`	pytest-dev/pytest-timeout	scanned	medium	2 errors 2 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:27` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:5` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`pytest-xdist==3.8.0`	pytest-dev/pytest-xdist	scanned	high	14 errors 5 warnings 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:33` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:50` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:50` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/deploy.yml:51` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:54` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/deploy.yml:54` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:72` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:20` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:27` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`python-dateutil==2.9.0.post0`	dateutil/dateutil	scanned	high	16 errors 7 warnings 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:25` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:22` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/validate.yml:98` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/validate.yml:161` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/validate.yml:192` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/validate.yml:213` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/validate.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/validate.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/validate.yml:46` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/validate.yml:150` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/validate.yml:189` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/validate.yml:210` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:105` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:112` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:144` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:161` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:168` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:172` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:192` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:195` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:213` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/validate.yml:215` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/validate.yml:91` unpinned image references: container image may be unpinned View on GitHub
`python-discovery==1.6.2`	tox-dev/python-discovery	scanned	high	clean
`python-dotenv==1.2.4`	theskumar/python-dotenv	scanned	high	4 warnings 2 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/release.yml:22` action's hash pin has mismatched or missing version comment: tag points to commit d23441a48e51 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/release.yml:25` action's hash pin has mismatched or missing version comment: tag points to commit ece7cb06caef View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:38` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/test.yml:38` action's hash pin has mismatched or missing version comment: tag points to commit d23441a48e51 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/test.yml:41` action's hash pin has mismatched or missing version comment: tag points to commit ece7cb06caef View on GitHub
`pytokens==0.4.1`	tusharsadhwani/pytokens	scanned	high	13 errors 2 warnings 4 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/primer.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/primer.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/primer.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/primer.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tox.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tox.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wheels.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wheels.yml:62` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wheels.yml:78` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:62` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:64` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:68` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:88` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:102` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`PyYAML==6.0.3`	yaml/pyyaml	scanned	high	27 errors 17 warnings 17 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:46` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:81` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:118` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:143` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:293` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:313` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:515` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:39` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:76` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:97` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:138` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:196` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:272` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:308` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:400` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:470` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:510` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:603` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:673` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:684` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:248` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:252` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:447` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:450` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:496` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:496` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yaml:650` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:81` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:109` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:115` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:119` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:143` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:207` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:213` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:220` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:265` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:288` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:294` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:313` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:413` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:419` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:426` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:463` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:483` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:515` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:619` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:625` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:632` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:666` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:678` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:695` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci.yaml:486` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci.yaml:628` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:84` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:146` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:316` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci.yaml:518` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`pyyaml_env_tag==1.1`	waylan/pyyaml-env-tag	scanned	high	10 errors 7 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:53` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:50` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:54` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/deploy.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`readchar==4.2.2`	magmax/python-readchar	scanned	high	18 errors 16 warnings 3 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yaml:18` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yaml:51` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yaml:74` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yaml:102` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yaml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yaml:15` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yaml:70` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yaml:98` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/publish.yaml:95` prefer trusted publishing for authentication: this command View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/publish.yaml:24` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/publish.yaml:33` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/publish.yaml:34` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/publish.yaml:115` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yaml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yaml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yaml:75` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yaml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yaml:103` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/publish.yaml:80` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/run-tests.yaml:25` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/run-tests.yaml:37` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/run-tests.yaml:63` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/run-tests.yaml:7` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/run-tests.yaml:22` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/run-tests.yaml:34` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/run-tests.yaml:49` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/run-tests.yaml:86` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/run-tests.yaml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/run-tests.yaml:28` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/run-tests.yaml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/run-tests.yaml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/run-tests.yaml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/run-tests.yaml:64` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/run-tests.yaml:66` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/run-tests.yaml:91` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/run-tests.yaml:40` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/run-tests.yaml:66` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub
`referencing==0.37.0`	python-jsonschema/referencing	scanned	high	clean
`refurb==2.3.1`	dosisod/refurb	scanned	high	clean
`regex==2026.9.29`	mrabarnett/mrab-regex	scanned	high	20 errors 11 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:83` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:132` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:160` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:17` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:39` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:67` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:114` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:147` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:180` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/main.yml:193` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:56` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:83` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:89` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:92` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:132` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:133` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:138` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:141` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:160` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:161` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:166` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:171` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:174` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:186` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:193` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`requests==2.34.2`	psf/requests	scanned	high	clean
`requirements-parser==0.13.1`	madpah/requirements-parser	scanned	high	16 errors 8 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:57` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:79` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:89` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/deploy.yml:94` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/poetry.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/poetry.yml:67` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/poetry.yml:108` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/poetry.yml:3` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/poetry.yml:26` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/poetry.yml:50` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/poetry.yml:86` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:69` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:78` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:110` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:115` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:123` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/poetry.yml:143` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`rich==15.0.0`	Textualize/rich	scanned	high	12 errors 8 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codespell.yml:7` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/codespell.yml:4` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codespell.yml:7` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/newissue.yml:11` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/newissue.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/newissue.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pythonpackage.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pythonpackage.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pythonpackage.yml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/readmechanged.yml:14` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/readmechanged.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/readmechanged.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`rich-argparse==1.8.0`	hamdanal/rich-argparse	scanned	high	5 errors 2 warnings 2 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-tests.yml:27` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/nightly-tests.yml:22` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/nightly-tests.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/nightly-tests.yml:28` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/nightly-tests.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:19` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`rpds-py==2026.9.1`	crate-py/rpds	scanned	high	clean
`ruff==0.17.0`	astral-sh/ruff	scanned	high	14 warnings 1 note zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yaml:426` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yaml:494` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yaml:612` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yaml:635` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yaml:667` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yaml:758` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yaml:879` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yaml:976` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/daily_fuzz.yaml:55` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/memory_report.yaml:88` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/release.yml:172` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/sync_typeshed.yaml:276` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ty-ecosystem-analyzer.yaml:88` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ty-ecosystem-report.yaml:69` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/typing_conformance.yaml:85` action's hash pin has mismatched or missing version comment: tag points to commit 10ca16bf91dc View on GitHub
`runs==1.3.0`	rec/runs	no workflows	low	-
`ruyaml==0.91.0`	pycontribs/ruyaml	scanned	high	11 errors 8 warnings 2 notes zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ack.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/ack.yml:3` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ack.yml:9` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/push.yml:11` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/push.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:30` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/release.yml:39` prefer trusted publishing for authentication: this step View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/release.yml:46` prefer trusted publishing for authentication: this step View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tox.yml:35` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tox.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tox.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tox.yml:72` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tox.yml:68` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`SecretStorage==3.5.0`	mitya57/secretstorage	scanned	high	7 errors 6 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:33` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:50` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:30` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:34` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`semantic-version==2.10.0`	rbarrois/python-semanticversion	scanned	medium	4 errors 4 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/check.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/check.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:36` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`setuptools==84.0.0`	pypa/setuptools	scanned	high	22 errors 9 warnings 5 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-sage.yml:60` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-sage.yml:74` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci-sage.yml:74` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-sage.yml:61` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-sage.yml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-sage.yml:83` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:114` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:167` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:215` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:243` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:91` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:114` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:116` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:152` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:168` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:173` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:179` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:215` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:221` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:243` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:245` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/main.yml:56` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/main.yml:56` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/main.yml:72` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pyright.yml:52` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pyright.yml:40` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pyright.yml:52` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pyright.yml:54` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pyright.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test-suite.yml:61` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test-suite.yml:93` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test-suite.yml:114` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-suite.yml:61` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-suite.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-suite.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test-suite.yml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`shellingham==1.5.4`	sarugaku/shellingham	scanned	medium	8 errors 6 warnings 3 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:11` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:29` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:20` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:29` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:18` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/known-vulnerable-actions: zizmor/known-vulnerable-actions `.github/workflows/publish.yml:50` action has a known vulnerability: GHSA-vxmw-7h4f-hqxh View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:50` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`six==1.17.0`	benjaminp/six	scanned	medium	5 errors 4 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:67` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:67` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:70` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/ci.yml:63` unpinned image references: container image may be unpinned View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/publish.yml:10` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/publish.yml:39` prefer trusted publishing for authentication: this command View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`sniffio==1.3.1`	python-trio/sniffio	scanned	high	7 errors 5 warnings 3 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:46` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:71` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:31` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:62` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:90` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:72` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:74` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`sortedcontainers==2.4.0`	quantopian/zipline	scanned	low	5 errors 4 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/windows_ci.yml:25` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/windows_ci.yml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/windows_ci.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/windows_ci.yml:48` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`stevedore==5.9.1`	-	no repo	-	-
`tabulate==0.10.0`	astanin/python-tabulate	scanned	high	5 errors 2 warnings 2 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/lint.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/lint.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/lint.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/lint.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tabulate.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tabulate.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tabulate.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tabulate.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tabulate.yml:31` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`termcolor==3.3.0`	termcolor/termcolor	scanned	high	clean
`textstat==0.7.13`	textstat/textstat	scanned	medium	2 errors 2 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:24` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`toml==0.10.2`	uiri/toml	scanned	medium	2 errors 2 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yaml:18` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yaml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yaml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`tomli==2.5.0`	hukkin/tomli	scanned	high	clean
`tomli_w==1.2.0`	hukkin/tomli-w	scanned	high	7 errors 8 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yaml:75` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:31` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:61` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yaml:69` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/tests.yaml:88` prefer trusted publishing for authentication: this command View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:40` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:43` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:57` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:75` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yaml:76` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`tomlkit==0.15.1`	python-poetry/tomlkit	scanned	high	10 errors 3 warnings 6 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/integration.yml:36` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/integration.yml:41` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/integration.yml:16` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/integration.yml:37` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/integration.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/integration.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/integration.yml:64` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/release.yml:50` prefer trusted publishing for authentication: this command View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:14` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/release.yml:39` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:13` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:28` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`totalhelp==0.1.1`	matthewdeanmartin/totalhelp	scanned	high	clean
`tox==4.65.1`	tox-dev/tox	scanned	high	clean
`tox-uv==1.36.1`	tox-dev/tox-uv	scanned	high	clean
`tox-uv-bare==1.36.1`	tox-dev/tox-uv	scanned	high	clean
`tqdm==4.70.1`	tqdm/tqdm	scanned	high	25 errors 8 warnings 12 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/check.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/check.yml:35` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/check.yml:71` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/check.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/check.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/check.yml:30` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/check.yml:66` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:48` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:71` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/check.yml:82` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/comment-bot.yml:11` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/comment-bot.yml:11` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/comment-bot.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/post-release.yml:9` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/post-release.yml:11` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/post-release.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/post-release.yml:6` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/post-release.yml:10` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/post-release.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/post-release.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/post-release.yml:22` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/post-release.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:73` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unsound-contains: zizmor/unsound-contains `.github/workflows/test.yml:9` unsound contains condition: contains(..) condition can be bypassed if attacker can control 'github.event.pull_request.author_association' View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:47` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test.yml:107` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/test.yml:107` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:23` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:73` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:77` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:85` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:110` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:113` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:120` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:128` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`troml-dev-status==0.7.0`	matthewdeanmartin/troml_dev_status	scanned	high	clean
`truststore==0.10.4`	sethmlarson/truststore	scanned	high	18 warnings 1 note zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:41` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:81` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:93` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:98` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:20` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:29` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:75` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:88` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yml:24` action's hash pin has mismatched or missing version comment: tag points to commit 11d5960a3267 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yml:42` action's hash pin has mismatched or missing version comment: tag points to commit 11d5960a3267 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yml:50` action's hash pin has mismatched or missing version comment: tag points to commit 40f1582b2485 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yml:81` action's hash pin has mismatched or missing version comment: tag points to commit 11d5960a3267 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yml:94` action's hash pin has mismatched or missing version comment: tag points to commit 11d5960a3267 View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/ci.yml:99` action's hash pin has mismatched or missing version comment: tag points to commit 11d5960a3267 View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/deploy.yml:13` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/known-vulnerable-actions: zizmor/known-vulnerable-actions `.github/workflows/deploy.yml:27` action has a known vulnerability: GHSA-vxmw-7h4f-hqxh View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/deploy.yml:14` action's hash pin has mismatched or missing version comment: tag points to commit 11d5960a3267 View on GitHub
`typer==0.27.3`	fastapi/typer	scanned	high	clean
`typeshed_client==2.13.0`	JelleZijlstra/typeshed_client	scanned	medium	15 errors 9 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/publish.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/publish.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/sync-typeshed.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sync-typeshed.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sync-typeshed.yml:20` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/sync-typeshed.yml:63` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:15` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:30` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/test.yml:44` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:8` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:26` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/test.yml:40` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:15` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:30` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:44` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/test.yml:46` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`typing_extensions==4.16.0`	python/typing_extensions	scanned	high	clean
`typing-inspect==0.9.0`	ilevkivskyi/typing_inspect	scanned	medium	4 errors 2 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:51` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:32` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:35` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`typing-inspection==0.4.4`	pydantic/typing-inspection	scanned	high	clean
`urllib3==2.8.0`	urllib3/urllib3	scanned	high	clean
`uv==0.13.0`	astral-sh/uv	scanned	high	23 warnings zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:32` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:55` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:73` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:97` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:152` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:181` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:187` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:198` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/ci.yml:212` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/issue-triage.yml:259` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/issue-triage.yml:281` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/publish-docker.yml:48` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/publish-docker.yml:67` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/pull-request-conflicts.yml:153` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:117` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:127` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:141` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:320` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:337` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:357` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:445` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:458` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub zizmor/secrets-inherit: zizmor/secrets-inherit `.github/workflows/release.yml:470` secrets unconditionally inherited by called workflow: this reusable workflow View on GitHub
`virtualenv==21.14.6`	pypa/virtualenv	scanned	high	clean
`vulture==2.16`	jendrikseipp/vulture	scanned	high	8 errors 2 warnings 3 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/main.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/main.yml:15` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:25` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:28` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/main.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pre-commit.yml:12` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/pre-commit.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pre-commit.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/pre-commit.yml:13` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/release.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/release.yml:19` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `enable-cache` enables caching for this action version View on GitHub
`watchdog==6.0.0`	gorakhargosh/watchdog	scanned	high	4 errors 4 warnings 7 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/all-contributors.yml:20` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/all-contributors.yml:33` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/all-contributors.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/all-contributors.yml:26` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/all-contributors.yml:54` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build-and-publish.yml:48` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build-and-publish.yml:74` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build-and-publish.yml:102` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/build-and-publish.yml:138` prefer trusted publishing for authentication: this step View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/build-and-publish.yml:64` action's hash pin has mismatched or missing version comment: tag points to commit cf430e030ddb View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/build-and-publish.yml:92` action's hash pin has mismatched or missing version comment: tag points to commit cf430e030ddb View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/build-and-publish.yml:115` action's hash pin has mismatched or missing version comment: tag points to commit cf430e030ddb View on GitHub zizmor/ref-version-mismatch: zizmor/ref-version-mismatch `.github/workflows/build-and-publish.yml:129` action's hash pin has mismatched or missing version comment: tag points to commit 9000827ccba6 View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:83` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub
`wcwidth==0.9.2`	jquast/wcwidth	scanned	high	45 errors 9 warnings 16 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:51` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:87` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:156` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:208` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:251` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:272` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:299` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:327` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:21` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:66` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:147` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:203` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:246` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:267` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:294` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci.yml:321` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:122` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:134` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/ci.yml:183` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:51` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:55` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:87` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:91` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:138` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:156` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:160` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:193` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:208` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:212` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:251` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:255` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:272` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:299` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:303` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:315` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:327` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:330` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:336` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:342` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:361` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci.yml:375` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:55` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:91` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:160` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:212` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:255` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:303` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci.yml:330` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql.yml:26` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:27` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:30` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codspeed.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codspeed.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wheels.yml:41` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wheels.yml:58` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wheels.yml:84` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:41` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:49` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:58` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:61` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:75` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:87` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/wheels.yml:94` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`xmod==1.10.0`	rec/xmod	no workflows	high	-
`yamlfix==1.19.1`	lyz-code/yamlfix	scanned	high	9 errors 9 warnings zizmor/artipacked: zizmor/artipacked `.github/workflows/build.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/build.yml:29` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:38` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/build.yml:47` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/install.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/install.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/install.yml:16` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/install.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/tests.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:2` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/tests.yml:52` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:19` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/tests.yml:21` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/update.yml:9` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/update.yml:12` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/update.yml:17` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub
`yarl==1.25.1`	aio-libs/yarl	scanned	medium	41 errors 15 warnings 21 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/aiohttp.yml:38` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/aiohttp.yml:44` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/aiohttp.yml:30` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/aiohttp.yml:39` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/aiohttp.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/aiohttp.yml:53` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/aiohttp.yml:53` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/auto-merge.yml:4` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/auto-merge.yml:18` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/bot-conditions: zizmor/bot-conditions `.github/workflows/auto-merge.yml:14` spoofable bot actor check: actor context may be spoofable View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:92` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:390` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci-cd.yml:544` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:3` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:69` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:142` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:161` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:226` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:327` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:351` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:535` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:576` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:593` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:612` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:631` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:647` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ci-cd.yml:659` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:89` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:93` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:391` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:393` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:400` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:411` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:473` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:523` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:545` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:547` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:553` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:625` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:643` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:768` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:776` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:809` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:823` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:830` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/ci-cd.yml:840` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/ci-cd.yml:411` runtime artifacts potentially vulnerable to a cache poisoning attack: this step View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:162` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:228` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:578` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:595` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/obfuscation: zizmor/obfuscation `.github/workflows/ci-cd.yml:661` obfuscated usage of GitHub Actions features: can be replaced by its static evaluation View on GitHub zizmor/superfluous-actions: zizmor/superfluous-actions `.github/workflows/ci-cd.yml:840` action functionality is already included by the runner: use `gh release` in a script step View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:98` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:265` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:583` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:601` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/ci-cd.yml:703` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/codeql.yml:32` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:33` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:36` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:42` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/codeql.yml:45` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/reusable-cibuildwheel.yml:88` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:99` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:106` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:111` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-cibuildwheel.yml:124` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/reusable-codspeed.yml:77` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/reusable-codspeed.yml:160` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-codspeed.yml:80` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-codspeed.yml:84` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-codspeed.yml:92` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-codspeed.yml:100` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-codspeed.yml:109` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/unpinned-uses: zizmor/unpinned-uses `.github/workflows/reusable-codspeed.yml:170` unpinned action reference: action is not pinned to a hash (required by blanket policy) View on GitHub zizmor/self-repository: zizmor/self-repository `.github/workflows/reusable-codspeed.yml:107` use GitHub's dedicated self-repository syntax: use '$/...' instead of './...' View on GitHub
`z3-solver==5.1.0.0`	Z3Prover/z3	scanned	medium	46 errors 7 warnings 105 notes zizmor/artipacked: zizmor/artipacked `.github/workflows/Windows.yml:17` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/Windows.yml:56` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/Windows.yml:1` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/Windows.yml:14` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/Windows.yml:40` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/Windows.yml:68` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/Windows.yml:74` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/Windows.yml:93` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/android-build.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/ast-order-warning-comment.yml:3` use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/build-z3-cache.yml:31` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/build-z3-cache.yml:71` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:30` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:72` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:121` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:176` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:288` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:452` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:573` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:610` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ci.yml:630` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/ci.yml:28` unpinned image references: container image uses the floating 'latest' tag View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/ci.yml:70` unpinned image references: container image uses the floating 'latest' tag View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/clang-tidy-warning-report.yml:19` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/clang-tidy-warning-report.yml:99` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/clang-tidy-warning-report.yml:100` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/code-conventions-analyzer.lock.yml:380` overly broad permissions: uses read-all permissions View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/compare-stats-anomaly-reporter.lock.yml:384` overly broad permissions: uses read-all permissions View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/coverage.yml:25` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/coverage.yml:86` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/cross-build.yml:22` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/csa-analysis.lock.yml:385` overly broad permissions: uses read-all permissions View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/determinism-comment.yml:5` use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/docs.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/docs.yml:48` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/docs.yml:27` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `cache` enables caching View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/docs.yml:52` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `package-manager-cache` enables caching View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/fstar-master-build.yml:63` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/github-env: zizmor/github-env `.github/workflows/memory-safety-report.lock.yml:469` dangerous use of environment file: write to GITHUB_ENV may allow code execution View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/memory-safety.yml:37` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/memory-safety.yml:123` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/memory-safety.yml:218` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/msvc-static-build-clang-cl.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/msvc-static-build.yml:16` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/nfv-formal-audit-dispatcher.yml:3` use of fundamentally insecure workflow trigger: pull_request_target is almost always used insecurely View on GitHub zizmor/github-app: zizmor/github-app `.github/workflows/nfv-formal-audit-dispatcher.yml:20` dangerous use of GitHub App tokens: app token inherits blanket installation permissions View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:29` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:89` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:144` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:199` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:258` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:294` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:330` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:386` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:419` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:456` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:495` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:535` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:578` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:607` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:644` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:681` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:713` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:768` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:820` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:876` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly-validation.yml:897` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/dangerous-triggers: zizmor/dangerous-triggers `.github/workflows/nightly-validation.yml:3` use of fundamentally insecure workflow trigger: workflow_run is almost always used insecurely View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:42` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:101` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:156` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:211` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:266` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:302` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:343` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:393` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:426` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:468` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:508` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:547` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:590` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:619` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:656` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:694` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:725` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:775` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:827` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly-validation.yml:904` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/github-env: zizmor/github-env `.github/workflows/nightly-validation.yml:782` dangerous use of environment file: write to GITHUB_ENV may allow code execution View on GitHub zizmor/github-env: zizmor/github-env `.github/workflows/nightly-validation.yml:834` dangerous use of environment file: write to GITHUB_ENV may allow code execution View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:43` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:81` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:122` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:181` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:239` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:268` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:303` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:356` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:394` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:449` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:510` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:537` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:564` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:595` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:670` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:715` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/nightly.yml:841` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/nightly.yml:24` overly broad permissions: contents: write is overly broad at the workflow level View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly.yml:648` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/nightly.yml:693` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/nightly.yml:354` unpinned image references: container image uses the floating 'latest' tag View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/nightly.yml:392` unpinned image references: container image uses the floating 'latest' tag View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/nightly.yml:447` unpinned image references: container image uses the floating 'latest' tag View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/nightly.yml:519` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/nightly.yml:546` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/nightly.yml:573` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/nightly.yml:645` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/nightly.yml:651` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/nightly.yml:690` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/nightly.yml:696` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/ocaml.yaml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/ocaml.yaml:12` overly broad permissions: default permissions used due to no permissions: block View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/pyodide-pypi.yml:21` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:40` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:84` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:128` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:187` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:245` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:274` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:309` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:362` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:400` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:455` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:516` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:543` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:570` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:601` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:676` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:721` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/release.yml:834` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/excessive-permissions: zizmor/excessive-permissions `.github/workflows/release.yml:23` overly broad permissions: contents: write is overly broad at the workflow level View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/release.yml:654` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/release.yml:699` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/template-injection: zizmor/template-injection `.github/workflows/release.yml:949` code injection via template expansion: may expand into attacker-controllable code View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/release.yml:360` unpinned image references: container image uses the floating 'latest' tag View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/release.yml:398` unpinned image references: container image uses the floating 'latest' tag View on GitHub zizmor/unpinned-images: zizmor/unpinned-images `.github/workflows/release.yml:453` unpinned image references: container image uses the floating 'latest' tag View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/release.yml:525` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/release.yml:552` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/release.yml:579` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/release.yml:651` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/release.yml:657` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/release.yml:696` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/misfeature: zizmor/misfeature `.github/workflows/release.yml:702` usage of GitHub Actions misfeatures: shell defined here View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wasm-release.yml:24` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub zizmor/use-trusted-publishing: zizmor/use-trusted-publishing `.github/workflows/wasm-release.yml:65` prefer trusted publishing for authentication: this command View on GitHub zizmor/cache-poisoning: zizmor/cache-poisoning `.github/workflows/wasm-release.yml:28` runtime artifacts potentially vulnerable to a cache poisoning attack: omitting `package-manager-cache` enables caching View on GitHub zizmor/artipacked: zizmor/artipacked `.github/workflows/wasm.yml:23` credential persistence through GitHub Actions artifacts: does not set persist-credentials: false View on GitHub
`zizmor==1.30.1`	zizmorcore/zizmor	scanned	high	clean