No signal changes detected since 2026-11-06.
| Environment | pytest | ruff | ty | bandit | pip-audit |
|---|---|---|---|---|---|
| linux-x64 / py3.14 | |||||
| linux-x64 / py3.14t | |||||
| linux-x64 / py3.15 | |||||
| macos-arm64 / py3.13 | |||||
| windows-x64 / py3.13 |
| Advisory | Package | Severity | Summary |
|---|---|---|---|
| GHSA-6q48-6c7w-9gw2 | certifi 2026.2.25 | critical | certifi bundles emSign root CAs with compromised intermediate CA keys |
| RUSTSEC-2026-0391 | zstd 0.13.3 | unknown | Data from an abandoned stream leaks into the next stream on a reused context |
| RUSTSEC-2026-0395 | zstd-safe 7.3.0 | unknown (unsound) | Use-after-free with `CParameter::StableInBuffer` |
| RUSTSEC-2026-0396 | zstd-safe 7.3.0 | unknown (unsound) | `Seekable` reads a NULL or out-of-bounds seek table |
| RUSTSEC-2026-0397 | zstd-safe 7.3.0 | unknown (unsound) | `OutBuffer::around_pos` exposes uninitialized memory |
| RUSTSEC-2026-0398 | zstd-safe 7.3.0 | unknown | `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end |
| RUSTSEC-2026-0399 | zstd-safe 7.3.0 | unknown (unsound) | Use-after-free through `init_using_cdict` and `init_using_ddict` |
| RUSTSEC-2026-0400 | zstd-safe 7.3.0 | unknown (unsound) | Use-after-free of a dictionary after a one-shot call on a context with an open stream |
| RUSTSEC-2026-0401 | zstd-safe 7.3.0 | unknown (unsound) | Out-of-bounds read in `train_from_buffer` when sample sizes overflow |
| RUSTSEC-2026-0402 | zstd-safe 7.3.0 | unknown (unsound) | Heap buffer overflow in `CCtx::try_clone` on a multithreaded context |
| RUSTSEC-2026-0403 | zstd-safe 7.3.0 | unknown | Uninitialized memory exposed when streaming decompression of a legacy frame fails |
| RUSTSEC-2026-0404 | zstd-safe 7.3.0 | unknown (unsound) | Double free in `DCtx::try_clone` |
| RUSTSEC-2026-0405 | zstd-safe 7.3.0 | unknown (unsound) | Out-of-bounds read with an out-of-range `InBuffer::pos` |
| RUSTSEC-2026-0406 | zstd-safe 7.3.0 | unknown (unsound) | Use-after-free when changing a multithreaded context with an unfinished frame |
| RUSTSEC-2026-0410 | zstd-sys 2.1.0+zstd.1.5.7 | unknown | WebAssembly allocator shim corrupts memory on allocation failure |
Suppressions are markers that silence a linter, type-checker, or security scanner. See security.html for the full ledger across the org.
Counts non-blank, non-comment lines (sloc). Excludes .venv,
target, dist, build,
__pycache__, _site, and lockfiles
(uv.lock, Cargo.lock). Tests are paths whose
ancestors contain tests, test, or
benches. Authorship: this codebase is
AI-assisted — lines were generated with Claude (Anthropic) and
human-reviewed before commit. We count what's in git;
we do not claim humans typed every character.