Skip to content
Security Audit

Security Audit #132

Sign in to view logs

Security Audit

Security Audit #132

Manually triggered August 25, 2026 21:53
@asklokeshasklokesh
⁠ 2493bc4
main
Status Success
Total duration 3m 41s
Artifacts 4

security-audit.yml

on: workflow_dispatch
npm audit (high+)
20s
npm audit (high+)
pip-audit (requirements reporting, SDK new-findings-blocking)
1m 7s
pip-audit (requirements reporting, SDK new-findings-blocking)
gitleaks (secrets, new-findings-blocking)
44s
gitleaks (secrets, new-findings-blocking)
bun audit (best-effort)
12s
bun audit (best-effort)
Matrix: sast
Fit to window
Zoom out
Zoom in

Annotations

15 warnings
bun audit (best-effort)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
bun audit (best-effort)
bun audit reported vulnerabilities (advisory; the npm audit job is the gate)
npm audit (high+)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
gitleaks (secrets, new-findings-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11d5960a326750d5838078e36cf38b85af677262, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
pip-audit (requirements reporting, SDK new-findings-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
pip-audit (requirements reporting, SDK new-findings-blocking)
[test-only] testonly-web-app_requirements-test.txt.json: ecdsa PYSEC-2026-1325
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-web-app_requirements.txt.json: ecdsa PYSEC-2026-1325
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-xph7-9rjv-w5fr
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-36p7-vc44-83pf
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-2wm9-hf6c-p5cr
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb PYSEC-2026-311
CodeQL SAST (python, critical-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324, github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (python, critical-blocking)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
CodeQL SAST (javascript-typescript, critical-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324, github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (javascript-typescript, critical-blocking)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/

Artifacts

Produced during runtime
Name Size Digest
codeql-sarif-javascript-typescript
123 KB
sha256:54135abf3c2e55c86c4be896e67470eb8d18a9f1cb6d50fb51032964e30fa9d1
codeql-sarif-python
168 KB
sha256:2953d77038076efbd791851925b067dac0a82b35dbbd51134bec8b0420880e6f
gitleaks-report
159 Bytes
sha256:08630063864627afb32afa6ab4475dfd3354d9691972de53a452041d72cc8904
pip-audit-reports
5.41 KB
sha256:13659cb3edb8c1211b62591890476789919b03d5c018c1d896c49bae412b7c14