Open advisories
430 open advisories in the locked dependencies of 18 package(s) (17 without a published severity).
See per-package rows below for breakdown.
Source: OSV.dev, which aggregates GitHub Security Advisories, PyPA and RustSec, queried for
every pin in each repo's uv.lock and Cargo.lock.
Verify via the methodology table.
Scanner rollup
How many packages currently have a green most-recent run, per tool. Packages without that tool configured are excluded from the denominator.
Per-repo security workflow
| Package | Workflow | gitleaks | bandit | vulture | pip-audit | cargo-audit | cargo-deny | Advisories | Last run |
|---|---|---|---|---|---|---|---|---|---|
| kaos-agents | 69 | — | |||||||
| kaos-citations | 20 | — | |||||||
| kaos-content | 52 | — | |||||||
| kaos-core | 1 | — | |||||||
| kaos-graph | 3 | — | |||||||
| kaos-llm-client | 6 | — | |||||||
| kaos-llm-core | 45 | — | |||||||
| kaos-mcp | 3 | — | |||||||
| kaos-ml-core | 54 | — | |||||||
| kaos-names | 0 | — | |||||||
| kaos-nlp-core | 15 | — | |||||||
| kaos-nlp-transformers | 20 | — | |||||||
| kaos-office | 44 | — | |||||||
| kaos-pdf | 47 | — | |||||||
| kaos-source | 44 | — | |||||||
| kaos-tabular | 3 | — | |||||||
| kaos-ui | 0 | — | |||||||
| kaos-web | 4 | — |
Suppressions ledger
Suppressions ledger not inspected on this host. sibling clone root /home/mjbommar/projects/273v not present on this host The ledger is computed at render time by walking the on-disk clones; on a build host without those clones (e.g. a fresh GHA runner) we leave the count empty rather than zero-fill it.
How this is collected
conclusion field on the most recent
run of each repo’s security.yml workflow. No
self-attestation. Tools that aren’t configured for a given
ecosystem (e.g. cargo-audit on a pure-Python package)
render as No signal rather than green.
The suppressions ledger is computed at render time by
collector.suppressions.collect_for_org, which walks the
on-disk sibling clones of every public 273v/kaos-* repo;
the same module exposes a per-repo collect() for ad-hoc
reproduction.
See methodology.html#pill-semantics
for the full signal-to-source mapping.