Skip to content
Security Audit

Security Audit #144

Sign in to view logs

Security Audit

Security Audit #144

Triggered via schedule August 31, 2026 14:55
@asklokeshasklokesh
⁠ bc0eee6
main
Status Success
Total duration 2m 45s
Artifacts 4

security-audit.yml

on: schedule
npm audit (high+)
18s
npm audit (high+)
pip-audit (requirements reporting, SDK new-findings-blocking)
1m 9s
pip-audit (requirements reporting, SDK new-findings-blocking)
gitleaks (secrets, new-findings-blocking)
46s
gitleaks (secrets, new-findings-blocking)
bun audit (best-effort)
9s
bun audit (best-effort)
Matrix: sast
Fit to window
Zoom out
Zoom in

Annotations

15 warnings
bun audit (best-effort)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
bun audit (best-effort)
bun audit reported vulnerabilities (advisory; the npm audit job is the gate)
npm audit (high+)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-node@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
gitleaks (secrets, new-findings-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@11d5960a326750d5838078e36cf38b85af677262, actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
pip-audit (requirements reporting, SDK new-findings-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/setup-python@v5, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
pip-audit (requirements reporting, SDK new-findings-blocking)
[test-only] testonly-web-app_requirements-test.txt.json: ecdsa PYSEC-2026-1325
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-web-app_requirements.txt.json: ecdsa PYSEC-2026-1325
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-xph7-9rjv-w5fr
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-36p7-vc44-83pf
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb GHSA-2wm9-hf6c-p5cr
pip-audit (requirements reporting, SDK new-findings-blocking)
[SHIPPED] shipped-mcp_requirements.txt.json: chromadb PYSEC-2026-311
CodeQL SAST (javascript-typescript, critical-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324, github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (javascript-typescript, critical-blocking)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/
CodeQL SAST (python, critical-blocking)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v4, actions/upload-artifact@v4, github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324, github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
CodeQL SAST (python, critical-blocking)
CodeQL Action v3 will be deprecated in December 2026. Please update all occurrences of the CodeQL Action in your workflow files to v4. For more information, see https://github.blog/changelog/2025-10-28-upcoming-deprecation-of-codeql-action-v3/

Artifacts

Produced during runtime
Name Size Digest
codeql-sarif-javascript-typescript
123 KB
sha256:dc8fa3d8f9a94e70fdb4ff5b3247c449123f9b6a942edc51b19eca26f2b7166a
codeql-sarif-python
168 KB
sha256:ff6ed11ec3d1bd6790c5fd39a3780f0dc03ee942116f8645a1fee613f2ca196d
gitleaks-report
159 Bytes
sha256:cd47cef20494e4161907f51476f238b127311c94ce533b7e741e4e56df208e5e
pip-audit-reports
5.41 KB
sha256:41abb15f138b2631c8f495e54e3e80c6cf0091682fc3e150b17eca405b7ee3be