Skip to content
Security Audit

Security Audit #137

Sign in to view logs

Security Audit

Security Audit #137

Manually triggered August 27, 2026 19:55
@asklokeshasklokesh
⁠ 0932211
main
Status Success
Total duration 3m 18s
Artifacts 4

security-audit.yml

on: workflow_dispatch
npm audit (high+)
14s
npm audit (high+)
pip-audit (requirements reporting, SDK new-findings-blocking)
1m 8s
pip-audit (requirements reporting, SDK new-findings-blocking)
gitleaks (secrets, new-findings-blocking)
54s
gitleaks (secrets, new-findings-blocking)
bun audit (best-effort)
12s
bun audit (best-effort)
Matrix: sast
Fit to window
Zoom out
Zoom in

Annotations

15 warnings
bun audit (best-effort)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
bun audit (best-effort)
bun audit reported vulnerabilities (advisory; the npm audit job is the gate)
npm audit (high+)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
gitleaks (secrets, new-findings-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11d5960a326750d5838078e36cf38b85af677262, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
pip-audit (requirements reporting, SDK new-findings-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
pip-audit (requirements reporting, SDK new-findings-blocking)
[test-only] testonly-web-app_requirements-test.txt.json: ecdsa PYSEC-2026-1325
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-web-app_requirements.txt.json: ecdsa PYSEC-2026-1325
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-xph7-9rjv-w5fr
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-36p7-vc44-83pf
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-2wm9-hf6c-p5cr
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb PYSEC-2026-311
CodeQL SAST (python, critical-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324, github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (python, critical-blocking)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
CodeQL SAST (javascript-typescript, critical-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324, github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (javascript-typescript, critical-blocking)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/

Artifacts

Produced during runtime
Name Size Digest
codeql-sarif-javascript-typescript
123 KB
sha256:d21c60a2218db05accd86e596566917bd43601e3e841f21e45ba8513cdf79486
codeql-sarif-python
169 KB
sha256:d086165ac0d6372c0706701477a58a8772f4d8c2e22f3a5b2b36fa9b15d5d50e
gitleaks-report
159 Bytes
sha256:459d900efce7a8567919308935ab483c3c76e7adff1da5b3ac1358f5f33e28c5
pip-audit-reports
5.41 KB
sha256:bcfcaebd8aa932889e46a4c80f39493c2bd9b5218be69ae933444f0dc8f2405e