kaos-llm-client v0.1.11

License: Apache-2.0 Runtime: Python 3.13+ Released: 2026-09-23 Repository

Changes since last sweep

No signal changes detected since 2026-11-06.

Trust scorecard

Composite: 8/9 green
Build passing
Latest CI conclusion: success
Tests: PR + compat + min-deps
PR lanes: success; compat: success; min-deps: success
Security scans + dependency advisories
security-light: success; security-full: failure; 6 open advisories (OSV.dev): 1 critical, 2 high, 3 moderate
Updates merged promptly
2 open PR(s), 2 from Dependabot; oldest 12 day(s) old
Signed release artifacts
PEP 740 attestation verified for 2/2 artifacts
License clean
Wheel license: Apache-2.0
SBOM published
SBOM published — 62 components
Branch protection
GitHub reports main as protected; admin-only rule details were not available to the sweep token
SECURITY.md + CODEOWNERS
SECURITY.md + CODEOWNERS present

CI matrix

Environment pytestruff tybandit pip-audit
linux-x64 / py3.14
linux-x64 / py3.14t
linux-x64 / py3.15
macos-arm64 / py3.13
windows-x64 / py3.13

Security

Open advisories
6 across 62 locked dependencies (OSV.dev)
Maintenance notices
0
Fixed in 90d
not tracked
Open Dependabot PRs
2
Suppressions (total)
not inspected (sibling clone absent)
AdvisoryPackageSeveritySummary
GHSA-6q48-6c7w-9gw2 certifi 2026.4.22 critical certifi bundles emSign root CAs with compromised intermediate CA keys
GHSA-8988-9cw3-xx77 urllib3 2.7.0 high urllib3: HTTPS proxy TLS configuration may be ignored or overridden
GHSA-vxq7-64xx-v4gw urllib3 2.7.0 high urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
GHSA-42vr-xj54-vc7v pyjwt 2.14.0 moderate PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
GHSA-gh4c-6fx4-qh6g urllib3 2.7.0 moderate urllib3: Chunked Deflate streaming can enter an infinite loop
GHSA-x33g-cr3x-6449 pyjwt 2.14.0 moderate PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion

Suppressions are markers that silence a linter, type-checker, or security scanner. See security.html for the full ledger across the org.

Supply chain

Direct deps
—
Transitive deps
—
SBOM
CycloneDX (mirror) · CycloneDX (GitHub Release)

Governance + velocity

Maintainers
2
Commits 90d
6
Releases 90d
1

Code surface area

Python source (LoC)
7,770 across 46 files
Python tests (LoC)
13,515 across 65 files
Rust source (LoC)
—
Rust tests (LoC)
—
Source lines of code
21,285 LoC

Counts non-blank, non-comment lines (sloc). Excludes .venv, target, dist, build, __pycache__, _site, and lockfiles (uv.lock, Cargo.lock). Tests are paths whose ancestors contain tests, test, or benches. Authorship: this codebase is AI-assisted — lines were generated with Claude (Anthropic) and human-reviewed before commit. We count what's in git; we do not claim humans typed every character.

Evidence

Download JSON

Methodology

How these eight checks are scored Each check is collected by an automated workflow against public sources only (GitHub API, OSV, Sigstore transparency log, package registry metadata). No self-attestation is accepted. A check is green when the underlying signal is present and meets a documented threshold, yellow when partial, red when failing, and gray when the collector has not yet implemented the probe. See methodology.html for thresholds and source URLs.