Skip to content
Security Audit

Security Audit #138

Sign in to view logs

Security Audit

Security Audit #138

Manually triggered August 27, 2026 20:10
@asklokeshasklokesh
⁠ 2ff50fa
main
Status Success
Total duration 3m 30s
Artifacts 4

security-audit.yml

on: workflow_dispatch
npm audit (high+)
17s
npm audit (high+)
pip-audit (requirements reporting, SDK new-findings-blocking)
1m 3s
pip-audit (requirements reporting, SDK new-findings-blocking)
gitleaks (secrets, new-findings-blocking)
42s
gitleaks (secrets, new-findings-blocking)
bun audit (best-effort)
13s
bun audit (best-effort)
Matrix: sast
Fit to window
Zoom out
Zoom in

Annotations

15 warnings
bun audit (best-effort)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
bun audit (best-effort)
bun audit reported vulnerabilities (advisory; the npm audit job is the gate)
npm audit (high+)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
gitleaks (secrets, new-findings-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11d5960a326750d5838078e36cf38b85af677262, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
pip-audit (requirements reporting, SDK new-findings-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
pip-audit (requirements reporting, SDK new-findings-blocking)
[test-only] testonly-web-app_requirements-test.txt.json: ecdsa PYSEC-2026-1325
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-web-app_requirements.txt.json: ecdsa PYSEC-2026-1325
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-xph7-9rjv-w5fr
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-36p7-vc44-83pf
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-2wm9-hf6c-p5cr
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb PYSEC-2026-311
CodeQL SAST (python, critical-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324, github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (python, critical-blocking)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
CodeQL SAST (javascript-typescript, critical-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324, github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (javascript-typescript, critical-blocking)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/

Artifacts

Produced during runtime
Name Size Digest
codeql-sarif-javascript-typescript
124 KB
sha256:26e60cf0f634591234a5587ab6dd1b317651b9e2735a42ee49a441709bd19ae2
codeql-sarif-python
169 KB
sha256:2e6bfd826ad993c8cbfd9a525739e22062625fe477d765fa8c04a24584ec851c
gitleaks-report
159 Bytes
sha256:2822c81fe36a38ceb510f7d57d6ee6d26af3721abb013d2361649caf043d53d0
pip-audit-reports
5.41 KB
sha256:c90149c24869c4dcf6ffc069bca21cf198ca10d034a816c674f99cf82e157e8f