build: bump the transpiler-minor group across 1 directory with 2 updates by dependabot[bot] · Pull Request #822 · awslabs/automated-security-helper

dependabot · 2026-10-23T03:06:30Z

Bumps the transpiler-minor group with 2 updates in the /ash-agent-plugins/agentic-coding/transpiler directory: pydantic and datamodel-code-generator.

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

Avoid Python tuple allocation during model fields validation by @Viicos in #13955

Avoid unnecessary extra dict allocation in model validation by @Viicos in #13956

Fixes

Fix arguments-v3 schema with variadic keywords by @Viicos in #13954

Fix TypeError on ForwardRef on Python 3.10.0 by @Viicos in #13964

Support closed and extra_items via inheritance in TypedDict by @Viicos in #13967

Enforce the max_digits whole-digits limit in the Python Decimal validator by @Viicos in #13972

Reject out-of-range int inputs for timedelta by @Viicos in #13973

Support named tuples in Sequence validation by @Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

Add support for multiple_of constraint in fraction and timedelta core schemas by @Viicos in #13873

Add __namespace__ parameter to create_model() by @Viicos in #13895

Changes

Add an ordered-dict core schema by @Viicos in #13796

Add a counter core schema by @Viicos in #13824

Do not mutate model_config attribute by @Viicos in #13825

Reject newlines in NameEmail validation by @Viicos in #13897

Fixes

Call enum constructors in both validation modes by @Viicos in #13792

Fix documentation examples not raising and remove unused string_sub_type unused error code by @Viicos in #13821

Catch OverflowError during ByteSize validation by @Viicos in #13850

Require multiple_of constraints to be positive by @Viicos in #13862

Always pop field name and model type stacks during schema generation by @saquibjawedbit in #13859

Handle TypeError gracefully during docstring extraction by @Viicos in #13874

Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @Viicos in #13891

Don't apply ser_json_timedelta to all datetime types in serialization inference by @Viicos in #13892

Encode JSON Schema defaults with a consistent configuration by @Viicos in #13893

Propagate init and kw_only=False from Field() to stdlib dataclass fields by @Viicos in #13898

Respect propagated extra config in the JSON Schema of stdlib dataclasses by @Viicos in #13899

Handle OS errors during ZoneInfo validation by @Viicos in #13912

Handle exceptions during Decimal validation by @Viicos in #13940

Rebuild incomplete types during serialization inference by @Viicos in #13922

Reject large exponents in Fraction validation by @Viicos in #13944

Avoid validating URL prefix multiple times in multi host URLs by @Viicos in #13945

New Contributors

@saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

b2212c7 Prepare release v2.14.1
968fb2b Fix docs conversion table
6adc8b3 Support named tuples in Sequence validation
7637fbc Reject out-of-range int inputs for timedelta
dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
e2456d3 Support closed and extra_items via inheritance in TypedDict
317655d Harden CI security
3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
43681ab Bump samuelcolvin/check-python-version action to v5.1
d6bc53a Avoid unnecessary extra dict allocation in model validation
Additional commits viewable in compare view

Updates datamodel-code-generator from 0.83.0 to 0.84.0

Release notes

Sourced from datamodel-code-generator's releases.

0.84.0

Highlights

Experimental: FastAPI server and Python client generation

Besides the models, datamodel-code-generator can now generate a FastAPI server package and a typed HTTPX2 client from one OpenAPI document. Both are new in 0.84.0 and experimental: options, templates and the generated packages may change in later releases (they are listed in the experimental registry with since_version 0.84.0). The generated code uses your generated models as its runtime contract: they validate requests and responses, and the generated server reads its packaged copy of the OpenAPI document only to serve it.

Get started:
# FastAPI server package in app/server/ (mkdir app && touch app/__init__.py first)
datamodel-codegen \
  --input openapi.yaml \
  --input-file-type openapi \
  --openapi-scopes schemas api \
  --output-model-type pydantic_v2.BaseModel \
  --preset standard-py312-20260909 \
  --output app/models.py \
  --generate-server fastapi \
  --server-output app/server \
  --server-package app.server \
  --server-model-package app.models
HTTPX2 client package in app/client/
datamodel-codegen 
--input openapi.yaml 
--input-file-type openapi 
--openapi-scopes schemas api 
--output-model-type pydantic_v2.BaseModel 
--preset standard-py312-20260909 
--output app/models.py 
--generate-client httpx2 
--client-output app/client 
--client-package app.client 
--client-model-package app.models
--generate-server / --generate-client require --server-output / --client-output, --server-package / --client-package (the import path of the package) and --server-model-package / --client-model-package (the import path of the models). --output names the model file (models.py above), not a package. The other --server-* / --client-* options are in the CLI reference.

A client needs a base URL: an operation without servers in the document needs --client-default-base-url, otherwise generation stops with an error

--generate-server and --generate-client require an explicit --input-file-type openapi: an input type left to detection, auto, or any other type stops with Error: --generate-server requires --input-file-type openapi, not auto and exit code 2 before the input is read (#4639)

Every server and client setting is a CLI option, a [tool.datamodel-codegen] key, and a generate() option; both targets reuse the model output options (formatters, file header, line length, and so on) (#4401, #4406, #4430)

--check, --diff-against, --watch and --output-format json work as for models, and so do batch jobs (#4438, #4442, #4443, #4517)

Target files are written like model files: edited files are overwritten, nothing is ever deleted, and --check lists leftover files as EXTRA (#4167, #4456, #4461). A generation that leaves .py files it no longer generates in the package, such as the router module of a removed tag, names them in one LeftoverFilesWarning (#4626). The required runtime dependencies are printed as a uv add ... command instead of being written to a requirements file (#4166); datamodel-code-generator does not edit pyproject.toml. --output-format json reports the package and the same dependencies as target.package and target.dependencies (#4680). The line asks for pydantic>=2.14.0, as does the client README (#4601, #4651). An explicit --target-pydantic-version older than that minimum (2, 2.11 or 2.12) is refused with Error: and exit code 2 for a server, and for a client whose models use pydantic; leave it unset or use 2.14 (#4627). A warning is shown when an existing package directory shadows a generated module, for server and client packages and also for plain model output (#4470).

Python API: pass generate_server="fastapi" or generate_client="httpx2" (plus server_* / client_* options) to generate(); with output=None it returns GeneratedModules with every model and package file (#4507)

Errors and warnings from the targets are regular dcg errors and Python warnings (#4421, #4434, #4516)

Groups of untagged operations: operations without a tag form the group default on both targets: routers/default.py, DefaultService, create_app(default=...) and the --server-router-names key default on the server, client.default on the client. A tag that itself derives default is numbered apart in declaration order (default, default_1) the same way on both (#4608).

Form bodies follow one rule on both targets: a multipart member, declared, inherited through allOf, or typed by additionalProperties, whose type has no single scalar kind (an object, a mapping, an array of objects, a mixed enum, or a union such as Filter | string or string | string[]) travels as application/json parts, one per item only for an array, and the server validates it with the member's model type. A member with a scalar kind travels as text, one value per array item. An explicit encoding.<name>.contentType naming one JSON media type is honoured by both targets (#4602, #4611). A member without a type ({}), each item of an array whose items have none, and other properties that the schema allows without a type travel as application/json parts too, a string included; the server keeps such a part that is not JSON as it arrives, text for a field and bytes for a file (#4728). The server parses a JSON part with the member's model field, so the field's constraints and discriminator apply; a model that populates by name also takes a part or field named like the Python field (max_age beside maxAge); typed other properties are checked by their type also when --reuse-model makes the form's model inherit an equal one; a form body whose schema is one schema or null is read and written as the form of that schema, and a multipart body that is a union of several schemas stops generation on both targets (needs an object schema to be sent as parts) (#4727). A client multipart body left without parts is sent as its closing boundary with a multipart/form-data Content-Type, which a server reads as an empty form (#4727).

Form encodings follow the OpenAPI version: an encoding's style, explode and allowReserved apply to URL-encoded bodies, and to multipart/form-data only in OpenAPI 3.1 and 3.2, whose parts carry the style's text without percent-encoding (the client refuses a delimited value that holds its delimiter); OpenAPI 3.0 ignores them for multipart, so the member is written and read as its contentType says. The server now reads styled members (form, deepObject, spaceDelimited, pipeDelimited), a URL-encoded member's contentType, and multipart members whose encoding names one UTF-8 or US-ASCII text media type or any media type for files, as the client writes them; a form whose exploded objects that allow other properties would take the same names stops generation on both targets, as such query parameters do (#4733), and so does such an exploded object next to other properties the form keeps, whether the schema declares them (additionalProperties true or a schema) or the model configuration keeps them (--extra-fields allow) (#4737).

Binary strings: a format: binary string is raw bytes that only a whole body (application/octet-stream, image/png, text/csv) or a multipart file part can carry; a text/* body whose model type is one binary string travels as raw bytes, also when the schema reaches it through $ref or a single allOf / anyOf / oneOf branch, beside null, a length limit or other binary strings (#4669), and the client method takes it as a binary body (bytes, a file object or a path). A binary string that would be sent as text (inside a JSON or URL-encoded body or response, a text/* body that is an object or array, a multipart part that is not a file, an item of a streamed response, a parameter or a header) stops generation on both targets with an error that names the operation and the schema location. Declare such a value format: byte for base64 text, optionally with --type-mappings string+byte=binary to hold the decoded bytes (#4658). The model type decides, so allOf: [{type: string}, {format: binary}] is a binary body too; bytes the models constrain (maxLength: 16 as conbytes(max_length=16)) are validated by the model: the server answers 422 to a request body and does not send a response body the model refuses, and the client raises DecodeError (unencodable for a bytes request body, invalid_value for a response) while files, paths and iterables stream unchecked. An enum or const of binary strings is text in the models and travels as text, and a binary body whose model types it as bytes only in part (type: [string, integer], bytes | int) stops generation (#4729)

Both targets stop on what no HTTP peer can carry (#4730): a header parameter, response header or part header whose name is not an RFC 9110 token (X Sp, X-Näme); a content key that is no media type (multipart/form data) or whose text is not ASCII header text (text/plain; label="café"); a URL-encoded body with patternProperties or that is not an object (the server reads such a body only with --server-body-mode request); a --server-router-names group key that matches no group (it was ignored) and a --client-resource-names tag that is the first tag of no operation. The server routes literal path text by its decoded value (/files/a%20b registers /files/a b, which the client's request /files/a%20b matches); literal %2F, %7B or %7D, and two operations of one method whose paths decode alike, stop generation. Client resources take their place among the derived names from their first operation, as server groups do.

... (truncated)

Changelog

Sourced from datamodel-code-generator's changelog.

0.84.0 - 2026-10-15

Highlights

Experimental: FastAPI server and Python client generation

Besides the models, datamodel-code-generator can now generate a FastAPI server package and a typed HTTPX2 client from one OpenAPI document. Both are new in 0.84.0 and experimental: options, templates and the generated packages may change in later releases (they are listed in the experimental registry with since_version 0.84.0). The generated code uses your generated models as its runtime contract: they validate requests and responses, and the generated server reads its packaged copy of the OpenAPI document only to serve it.

Get started:
# FastAPI server package in app/server/ (mkdir app && touch app/__init__.py first)
datamodel-codegen \
  --input openapi.yaml \
  --input-file-type openapi \
  --openapi-scopes schemas api \
  --output-model-type pydantic_v2.BaseModel \
  --preset standard-py312-20260909 \
  --output app/models.py \
  --generate-server fastapi \
  --server-output app/server \
  --server-package app.server \
  --server-model-package app.models
HTTPX2 client package in app/client/
datamodel-codegen 
--input openapi.yaml 
--input-file-type openapi 
--openapi-scopes schemas api 
--output-model-type pydantic_v2.BaseModel 
--preset standard-py312-20260909 
--output app/models.py 
--generate-client httpx2 
--client-output app/client 
--client-package app.client 
--client-model-package app.models
--generate-server / --generate-client require --server-output / --client-output, --server-package / --client-package (the import path of the package) and --server-model-package / --client-model-package (the import path of the models). --output names the model file (models.py above), not a package. The other --server-* / --client-* options are in the CLI reference.

A client needs a base URL: an operation without servers in the document needs --client-default-base-url, otherwise generation stops with an error

--generate-server and --generate-client require an explicit --input-file-type openapi: an input type left to detection, auto, or any other type stops with Error: --generate-server requires --input-file-type openapi, not auto and exit code 2 before the input is read (#4639)

Every server and client setting is a CLI option, a [tool.datamodel-codegen] key, and a generate() option; both targets reuse the model output options (formatters, file header, line length, and so on) (#4401, #4406, #4430)

--check, --diff-against, --watch and --output-format json work as for models, and so do batch jobs (#4438, #4442, #4443, #4517)

Target files are written like model files: edited files are overwritten, nothing is ever deleted, and --check lists leftover files as EXTRA (#4167, #4456, #4461). A generation that leaves .py files it no longer generates in the package, such as the router module of a removed tag, names them in one LeftoverFilesWarning (#4626). The required runtime dependencies are printed as a uv add ... command instead of being written to a requirements file (#4166); datamodel-code-generator does not edit pyproject.toml. --output-format json reports the package and the same dependencies as target.package and target.dependencies (#4680). The line asks for pydantic>=2.14.0, as does the client README (#4601, #4651). An explicit --target-pydantic-version older than that minimum (2, 2.11 or 2.12) is refused with Error: and exit code 2 for a server, and for a client whose models use pydantic; leave it unset or use 2.14 (#4627). A warning is shown when an existing package directory shadows a generated module, for server and client packages and also for plain model output (#4470).

Python API: pass generate_server="fastapi" or generate_client="httpx2" (plus server_* / client_* options) to generate(); with output=None it returns GeneratedModules with every model and package file (#4507)

Errors and warnings from the targets are regular dcg errors and Python warnings (#4421, #4434, #4516)

Groups of untagged operations: operations without a tag form the group default on both targets: routers/default.py, DefaultService, create_app(default=...) and the --server-router-names key default on the server, client.default on the client. A tag that itself derives default is numbered apart in declaration order (default, default_1) the same way on both (#4608).

Form bodies follow one rule on both targets: a multipart member, declared, inherited through allOf, or typed by additionalProperties, whose type has no single scalar kind (an object, a mapping, an array of objects, a mixed enum, or a union such as Filter | string or string | string[]) travels as application/json parts, one per item only for an array, and the server validates it with the member's model type. A member with a scalar kind travels as text, one value per array item. An explicit encoding.<name>.contentType naming one JSON media type is honoured by both targets (#4602, #4611). A member without a type ({}), each item of an array whose items have none, and other properties that the schema allows without a type travel as application/json parts too, a string included; the server keeps such a part that is not JSON as it arrives, text for a field and bytes for a file (#4728). The server parses a JSON part with the member's model field, so the field's constraints and discriminator apply; a model that populates by name also takes a part or field named like the Python field (max_age beside maxAge); typed other properties are checked by their type also when --reuse-model makes the form's model inherit an equal one; a form body whose schema is one schema or null is read and written as the form of that schema, and a multipart body that is a union of several schemas stops generation on both targets (needs an object schema to be sent as parts) (#4727). A client multipart body left without parts is sent as its closing boundary with a multipart/form-data Content-Type, which a server reads as an empty form (#4727).

Form encodings follow the OpenAPI version: an encoding's style, explode and allowReserved apply to URL-encoded bodies, and to multipart/form-data only in OpenAPI 3.1 and 3.2, whose parts carry the style's text without percent-encoding (the client refuses a delimited value that holds its delimiter); OpenAPI 3.0 ignores them for multipart, so the member is written and read as its contentType says. The server now reads styled members (form, deepObject, spaceDelimited, pipeDelimited), a URL-encoded member's contentType, and multipart members whose encoding names one UTF-8 or US-ASCII text media type or any media type for files, as the client writes them; a form whose exploded objects that allow other properties would take the same names stops generation on both targets, as such query parameters do (#4733), and so does such an exploded object next to other properties the form keeps, whether the schema declares them (additionalProperties true or a schema) or the model configuration keeps them (--extra-fields allow) (#4737).

Binary strings: a format: binary string is raw bytes that only a whole body (application/octet-stream, image/png, text/csv) or a multipart file part can carry; a text/* body whose model type is one binary string travels as raw bytes, also when the schema reaches it through $ref or a single allOf / anyOf / oneOf branch, beside null, a length limit or other binary strings (#4669), and the client method takes it as a binary body (bytes, a file object or a path). A binary string that would be sent as text (inside a JSON or URL-encoded body or response, a text/* body that is an object or array, a multipart part that is not a file, an item of a streamed response, a parameter or a header) stops generation on both targets with an error that names the operation and the schema location. Declare such a value format: byte for base64 text, optionally with --type-mappings string+byte=binary to hold the decoded bytes (#4658). The model type decides, so allOf: [{type: string}, {format: binary}] is a binary body too; bytes the models constrain (maxLength: 16 as conbytes(max_length=16)) are validated by the model: the server answers 422 to a request body and does not send a response body the model refuses, and the client raises DecodeError (unencodable for a bytes request body, invalid_value for a response) while files, paths and iterables stream unchecked. An enum or const of binary strings is text in the models and travels as text, and a binary body whose model types it as bytes only in part (type: [string, integer], bytes | int) stops generation (#4729)

... (truncated)

Commits

213ff2c Keep root model references beside allOf constraints unless root models collap...
218a2d7 Keep discriminated unions with different mappings apart when reusing models (...
536064f Keep models named Literal when reused variants get Literal tags (#4761)
1926d06 Rename same-named fields and types only to names no field uses (#4758)
d14ef07 Skip the test matrix on mid-stack layers of native stacked PRs (#4699)
a161259 Close allOf models when a member forbids additional properties (#4739)
3a01b71 Leave msgspec constraints off unions of members of one kind (#4738)
3dafb2e Refuse absorbing form members when other properties are kept (#4737)
4323262 Align the docs with the 0.84.0 server, client and model changes (#4736)
cadf727 Map discriminator tags to reused models and keep contains bounds (#4735)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the transpiler-minor group with 2 updates in the /ash-agent-plugins/agentic-coding/transpiler directory: [pydantic](https://github.com/pydantic/pydantic) and [datamodel-code-generator](https://github.com/datamodel-code-generator/datamodel-code-generator). Updates `pydantic` from 2.13.5 to 2.14.1 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.13.5...v2.14.1) Updates `datamodel-code-generator` from 0.83.0 to 0.84.0 - [Release notes](https://github.com/datamodel-code-generator/datamodel-code-generator/releases) - [Changelog](https://github.com/datamodel-code-generator/datamodel-code-generator/blob/main/CHANGELOG.md) - [Commits](datamodel-code-generator/datamodel-code-generator@0.83.0...0.84.0) --- updated-dependencies: - dependency-name: pydantic dependency-version: 2.14.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: transpiler-minor - dependency-name: datamodel-code-generator dependency-version: 0.84.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: transpiler-minor ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-10-23T03:10:23Z

ASH Security Scan Report

Report generated: 2026-10-23T03:10:19+00:00
Time since scan: 2 minutes

Scan Metadata

Project: ASH
Scan executed: 2026-10-23T03:07:46+00:00
ASH version: 3.7.0

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

Severity levels:
- Suppressed (S): Findings that have been explicitly suppressed and don't affect scanner status
- Critical (C): Highest severity findings that require immediate attention
- High (H): Serious findings that should be addressed soon
- Medium (M): Moderate risk findings
- Low (L): Lower risk findings
- Info (I): Informational findings with minimal risk
Actionable: Number of findings at or above the threshold severity level that require attention
Result:
- PASSED = No findings at or above threshold
- FAILED = Findings at or above threshold
- MISSING = Required dependencies not available
- SKIPPED = Scanner explicitly disabled
- ERROR = Scanner execution error
Threshold: The minimum severity level that will cause a scanner to fail
- Thresholds: ALL, LOW, MEDIUM, HIGH, CRITICAL
- Source: Values in parentheses indicate where the threshold is set:
  - global (global_settings section in the ASH_CONFIG used)
  - config (scanner config section in the ASH_CONFIG used)
  - scanner (default configuration in the plugin, if explicitly set)
Statistics calculation:
- All statistics are calculated from the final aggregated SARIF report
- Suppressed findings are counted separately and do not contribute to actionable findings
- Scanner status is determined by comparing actionable findings to the threshold

Scanner	Suppressed	Critical	High	Medium	Low	Actionable	Result	Threshold
bandit	67	0	0	0	107	0	PASSED	MEDIUM (global)
cdk-nag	666	0	0	0	0	0	PASSED	MEDIUM (global)
cfn-nag	24	0	0	0	0	0	PASSED	MEDIUM (global)
checkov	78	0	0	0	0	0	PASSED	LOW (config)
detect-secrets	30	0	0	0	0	0	PASSED	MEDIUM (global)
grype	0	3	6	2	0	11	FAILED	MEDIUM (global)
npm-audit	5	0	0	1	0	1	FAILED	MEDIUM (global)
opengrep	0	0	0	0	0	0	PASSED	MEDIUM (global)
semgrep	0	0	0	0	0	0	PASSED	MEDIUM (global)
syft	0	0	0	0	0	0	PASSED	MEDIUM (global)

Top 3 Hotspots

Files with the highest number of security findings:

Finding Count	File Location
9	uv.lock
2	ash-agent-plugins/agentic-coding/transpiler/uv.lock
1	node_modules/stream-json/package.json

Detailed Findings

Show 12 actionable findings

Finding 1: GHSA-jj87-hc4r-jwfw

Severity: MEDIUM
Scanner: npm-audit
Rule ID: GHSA-jj87-hc4r-jwfw
Location: node_modules/stream-json/package.json:1

Description:
stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service in stream-json 2.0.0 - 3.6.0. GHSA-jj87-hc4r-jwfw