{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:18:05.768254Z","repo":{"ref":{"host":"github.com","owner":"CocoaPods","name":"CocoaPods"},"default_branch":"master","clone_url":"https://github.com/CocoaPods/CocoaPods.git","html_url":"https://github.com/CocoaPods/CocoaPods","description":"The Cocoa Dependency Manager.","stars":14833,"forks":2686,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":98379,"primary_language":"Ruby","license_spdx":"NOASSERTION","created_at":"2011-08-14T00:10:53Z","pushed_at":"2026-07-06T21:36:05Z","security_policy_url":null,"distribution":{"owner_created_at":"2011-11-12T01:44:28Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2","profile":{"lines_by_language":{"Ruby":54592,"C":3414,"Swift":2445,"Objective-C":2339,"Shell":482},"files_by_category":{"config":3266,"generated":1786,"other":926,"test":559,"source":369,"binary":295,"docs":158,"oversized":24},"source_lines":29819,"test_lines":33453},"pillars":{"ai_provenance":{"score":0.0,"confidence":0.65,"coverage":1.0,"label":"none-detected","breakdown":{"attributed_share":0.0,"suspected_share":0.0,"estimated_share":0.0,"ai_artifacts":0.0,"flagged_work_units":0.0,"flagged_releases":0.0,"style_index":0.05},"summary":"No AI attribution or AI-consistent velocity signals detected."},"quality":{"score":74.4,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":93.5,"duplication":63.0,"lint":100.0,"testing":70.0,"docs":100.0,"type_safety":null,"process":0.0},"summary":"Code quality is adequate: test-to-source ratio 1.12, no CI test run detected; 2% of function code in complex or long functions; 8% duplicated lines. Weakest area: process."},"security":{"score":51.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":64.8,"sast":90.6,"dependencies":69.3,"ci_actions":11.8,"posture":0.0,"scorecard":18.6},"summary":"Security posture is weak: 15 known vulnerabilities in 4 dependencies; 3 high-severity SAST findings; 10 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"ok","tool_version":"scorecard v5.6.0","metrics":{"aggregate":2.0,"check:Maintained":0.0,"check:Code-Review":0.0,"check:Token-Permissions":0.0,"check:Dangerous-Workflow":10.0,"check:CII-Best-Practices":0.0,"check:Security-Policy":0.0,"check:Fuzzing":0.0,"check:License":9.0,"check:Binary-Artifacts":0.0,"check:Branch-Protection":3.0,"check:Pinned-Dependencies":0.0,"check:SAST":0.0},"findings":[],"evidence":[{"kind":"scorecard-check","description":"Scorecard Maintained: 0/10 (0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0)","ref":"Maintained","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Code-Review: 0/10 (Found 1/12 approved changesets -- score normalized to 0)","ref":"Code-Review","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Token-Permissions: 0/10 (detected GitHub workflow tokens with excessive permissions)","ref":"Token-Permissions","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Dangerous-Workflow: 10/10 (no dangerous workflow patterns detected)","ref":"Dangerous-Workflow","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":0.0},{"kind":"scorecard-check","description":"Scorecard CII-Best-Practices: 0/10 (no effort to earn an OpenSSF best practices badge detected)","ref":"CII-Best-Practices","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Security-Policy: 0/10 (security policy file not detected)","ref":"Security-Policy","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Fuzzing: 0/10 (project is not fuzzed)","ref":"Fuzzing","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0},{"kind":"scorecard-check","description":"Scorecard License: 9/10 (license file detected)","ref":"License","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":0.1},{"kind":"scorecard-check","description":"Scorecard Binary-Artifacts: 0/10 (binaries present in source code)","ref":"Binary-Artifacts","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0},{"kind":"scorecard-check","description":"Scorecard Branch-Protection: 3/10 (branch protection is not maximal on development and all release branches)","ref":"Branch-Protection","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":0.7},{"kind":"scorecard-check","description":"Scorecard Pinned-Dependencies: 0/10 (dependency not pinned by hash detected -- score normalized to 0)","ref":"Pinned-Dependencies","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0},{"kind":"scorecard-check","description":"Scorecard SAST: 0/10 (SAST tool is not run on all commits -- score normalized to 0)","ref":"SAST","url":"https://scorecard.dev/viewer/?uri=github.com/CocoaPods/CocoaPods","weight":1.0}],"data":{"date":"2026-11-09","commit":"b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2","matches_head":true},"error":null},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":8190.0,"attributed_commits":0.0,"attributed_commit_share":0.0,"effective_loc":181984.0,"attributed_loc":0.0,"attributed_loc_share":0.0,"tools_detected":0.0},"findings":[],"evidence":[],"data":{"attributed_loc_by_commit":{},"tools":{},"monthly":{"2011-08":{"loc":492,"attributed_loc":0},"2011-09":{"loc":4455,"attributed_loc":0},"2011-10":{"loc":4451,"attributed_loc":0},"2011-11":{"loc":5040,"attributed_loc":0},"2011-12":{"loc":44,"attributed_loc":0},"2012-01":{"loc":36,"attributed_loc":0},"2012-02":{"loc":1175,"attributed_loc":0},"2012-03":{"loc":4066,"attributed_loc":0},"2012-04":{"loc":4958,"attributed_loc":0},"2012-05":{"loc":4015,"attributed_loc":0},"2012-06":{"loc":1122,"attributed_loc":0},"2012-07":{"loc":1237,"attributed_loc":0},"2012-08":{"loc":4153,"attributed_loc":0},"2012-09":{"loc":2519,"attributed_loc":0},"2012-10":{"loc":2559,"attributed_loc":0},"2012-11":{"loc":3813,"attributed_loc":0},"2012-12":{"loc":7216,"attributed_loc":0},"2013-01":{"loc":812,"attributed_loc":0},"2013-02":{"loc":7408,"attributed_loc":0},"2013-03":{"loc":940,"attributed_loc":0},"2013-04":{"loc":1394,"attributed_loc":0},"2013-05":{"loc":2542,"attributed_loc":0},"2013-06":{"loc":1727,"attributed_loc":0},"2013-07":{"loc":1887,"attributed_loc":0},"2013-08":{"loc":985,"attributed_loc":0},"2013-09":{"loc":86,"attributed_loc":0},"2013-10":{"loc":941,"attributed_loc":0},"2013-11":{"loc":549,"attributed_loc":0},"2013-12":{"loc":433,"attributed_loc":0},"2014-01":{"loc":132,"attributed_loc":0},"2014-02":{"loc":315,"attributed_loc":0},"2014-03":{"loc":712,"attributed_loc":0},"2014-04":{"loc":1565,"attributed_loc":0},"2014-05":{"loc":564,"attributed_loc":0},"2014-06":{"loc":714,"attributed_loc":0},"2014-07":{"loc":671,"attributed_loc":0},"2014-08":{"loc":3919,"attributed_loc":0},"2014-09":{"loc":1421,"attributed_loc":0},"2014-10":{"loc":3778,"attributed_loc":0},"2014-11":{"loc":2177,"attributed_loc":0},"2014-12":{"loc":1465,"attributed_loc":0},"2015-01":{"loc":1598,"attributed_loc":0},"2015-02":{"loc":589,"attributed_loc":0},"2015-03":{"loc":702,"attributed_loc":0},"2015-04":{"loc":1462,"attributed_loc":0},"2015-05":{"loc":2821,"attributed_loc":0},"2015-06":{"loc":1115,"attributed_loc":0},"2015-07":{"loc":889,"attributed_loc":0},"2015-08":{"loc":565,"attributed_loc":0},"2015-09":{"loc":1100,"attributed_loc":0},"2015-10":{"loc":1026,"attributed_loc":0},"2015-11":{"loc":1129,"attributed_loc":0},"2015-12":{"loc":1435,"attributed_loc":0},"2016-01":{"loc":910,"attributed_loc":0},"2016-02":{"loc":880,"attributed_loc":0},"2016-03":{"loc":6079,"attributed_loc":0},"2016-04":{"loc":5778,"attributed_loc":0},"2016-05":{"loc":1990,"attributed_loc":0},"2016-06":{"loc":3967,"attributed_loc":0},"2016-07":{"loc":552,"attributed_loc":0},"2016-08":{"loc":341,"attributed_loc":0},"2016-09":{"loc":496,"attributed_loc":0},"2016-10":{"loc":454,"attributed_loc":0},"2016-11":{"loc":326,"attributed_loc":0},"2016-12":{"loc":100,"attributed_loc":0},"2017-01":{"loc":178,"attributed_loc":0},"2017-02":{"loc":195,"attributed_loc":0},"2017-03":{"loc":404,"attributed_loc":0},"2017-04":{"loc":19,"attributed_loc":0},"2017-05":{"loc":1122,"attributed_loc":0},"2017-06":{"loc":1448,"attributed_loc":0},"2017-07":{"loc":426,"attributed_loc":0},"2017-08":{"loc":556,"attributed_loc":0},"2017-09":{"loc":1550,"attributed_loc":0},"2017-10":{"loc":782,"attributed_loc":0},"2017-11":{"loc":379,"attributed_loc":0},"2017-12":{"loc":222,"attributed_loc":0},"2018-01":{"loc":7383,"attributed_loc":0},"2018-02":{"loc":1586,"attributed_loc":0},"2018-03":{"loc":2829,"attributed_loc":0},"2018-04":{"loc":3026,"attributed_loc":0},"2018-05":{"loc":540,"attributed_loc":0},"2018-06":{"loc":1054,"attributed_loc":0},"2018-07":{"loc":1144,"attributed_loc":0},"2018-08":{"loc":1763,"attributed_loc":0},"2018-09":{"loc":389,"attributed_loc":0},"2018-10":{"loc":2363,"attributed_loc":0},"2018-11":{"loc":2145,"attributed_loc":0},"2018-12":{"loc":2288,"attributed_loc":0},"2019-01":{"loc":754,"attributed_loc":0},"2019-02":{"loc":1353,"attributed_loc":0},"2019-03":{"loc":679,"attributed_loc":0},"2019-04":{"loc":1980,"attributed_loc":0},"2019-05":{"loc":387,"attributed_loc":0},"2019-06":{"loc":756,"attributed_loc":0},"2019-07":{"loc":1845,"attributed_loc":0},"2019-08":{"loc":495,"attributed_loc":0},"2019-09":{"loc":939,"attributed_loc":0},"2019-10":{"loc":606,"attributed_loc":0},"2019-11":{"loc":955,"attributed_loc":0},"2019-12":{"loc":886,"attributed_loc":0},"2020-01":{"loc":263,"attributed_loc":0},"2020-02":{"loc":1160,"attributed_loc":0},"2020-03":{"loc":1066,"attributed_loc":0},"2020-04":{"loc":1539,"attributed_loc":0},"2020-05":{"loc":161,"attributed_loc":0},"2020-06":{"loc":331,"attributed_loc":0},"2020-07":{"loc":328,"attributed_loc":0},"2020-08":{"loc":185,"attributed_loc":0},"2020-09":{"loc":845,"attributed_loc":0},"2020-10":{"loc":1338,"attributed_loc":0},"2020-11":{"loc":288,"attributed_loc":0},"2020-12":{"loc":48,"attributed_loc":0},"2021-01":{"loc":858,"attributed_loc":0},"2021-02":{"loc":25,"attributed_loc":0},"2021-03":{"loc":84,"attributed_loc":0},"2021-04":{"loc":40,"attributed_loc":0},"2021-06":{"loc":1,"attributed_loc":0},"2021-07":{"loc":481,"attributed_loc":0},"2021-08":{"loc":783,"attributed_loc":0},"2021-09":{"loc":238,"attributed_loc":0},"2021-10":{"loc":12,"attributed_loc":0},"2021-11":{"loc":31,"attributed_loc":0},"2021-12":{"loc":3,"attributed_loc":0},"2022-01":{"loc":60,"attributed_loc":0},"2022-02":{"loc":242,"attributed_loc":0},"2022-03":{"loc":744,"attributed_loc":0},"2022-04":{"loc":0,"attributed_loc":0},"2022-06":{"loc":14,"attributed_loc":0},"2022-09":{"loc":133,"attributed_loc":0},"2022-10":{"loc":56,"attributed_loc":0},"2022-11":{"loc":5,"attributed_loc":0},"2022-12":{"loc":12,"attributed_loc":0},"2023-01":{"loc":7,"attributed_loc":0},"2023-02":{"loc":42,"attributed_loc":0},"2023-03":{"loc":2,"attributed_loc":0},"2023-04":{"loc":15,"attributed_loc":0},"2023-06":{"loc":31,"attributed_loc":0},"2023-07":{"loc":7,"attributed_loc":0},"2023-09":{"loc":27,"attributed_loc":0},"2023-10":{"loc":7,"attributed_loc":0},"2023-11":{"loc":82,"attributed_loc":0},"2023-12":{"loc":3,"attributed_loc":0},"2024-01":{"loc":23,"attributed_loc":0},"2024-02":{"loc":6,"attributed_loc":0},"2024-04":{"loc":15,"attributed_loc":0},"2024-05":{"loc":17,"attributed_loc":0},"2024-07":{"loc":55,"attributed_loc":0},"2024-08":{"loc":0,"attributed_loc":0},"2024-09":{"loc":0,"attributed_loc":0},"2024-10":{"loc":26,"attributed_loc":0},"2024-11":{"loc":14,"attributed_loc":0},"2025-05":{"loc":0,"attributed_loc":0},"2025-08":{"loc":0,"attributed_loc":0},"2026-07":{"loc":13,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":3388.0,"flagged_units":0.0,"pre_ai_era_bursts":4.0,"pre_ai_era_measured_loc":172469.0,"pre_ai_era_burst_loc":13849.0,"measured_loc":175676.0,"flagged_loc":0.0,"flagged_loc_share":0.0,"max_loc_per_hour":4879.844097995546,"median_loc_per_hour":50.28136289692682,"pr_timed_units":11.0,"excluded_import_loc":6308.0},"findings":[],"evidence":[],"data":{"flagged_loc_by_commit":{},"excluded_import_commits":["cbf2317d1dfaedddecdd6e0d956d62748be0ac7a"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":99.0,"flagged_releases":0.0,"max_loc_per_day":69765.8},"findings":[],"evidence":[],"data":{"releases":[{"from":"0.39.0.beta.4","to":"0.39.0.beta.5","loc":415,"days":29.73,"loc_per_day":14.0,"flagged":false},{"from":"0.39.0.beta.5","to":"0.39.0.rc.1","loc":143,"days":3.9,"loc_per_day":36.6,"flagged":false},{"from":"0.39.0.rc.1","to":"0.39.0","loc":63,"days":3.94,"loc_per_day":16.0,"flagged":false},{"from":"0.39.0","to":"1.0.0.beta.1","loc":3933,"days":82.17,"loc_per_day":47.9,"flagged":false},{"from":"1.0.0.beta.1","to":"1.0.0.beta.2","loc":171,"days":5.95,"loc_per_day":28.7,"flagged":false},{"from":"1.0.0.beta.2","to":"1.0.0.beta.3","loc":269,"days":28.25,"loc_per_day":9.5,"flagged":false},{"from":"1.0.0.beta.3","to":"1.0.0.beta.4","loc":1446,"days":21.07,"loc_per_day":68.6,"flagged":false},{"from":"1.0.0.beta.4","to":"1.0.0.beta.5","loc":288,"days":12.95,"loc_per_day":22.2,"flagged":false},{"from":"1.0.0.beta.5","to":"1.0.0.beta.6","loc":610,"days":6.96,"loc_per_day":87.7,"flagged":false},{"from":"1.0.0.beta.6","to":"1.0.0.beta.7","loc":10644,"days":30.96,"loc_per_day":343.8,"flagged":false},{"from":"1.0.0.beta.7","to":"1.0.0.beta.8","loc":145,"days":0.86,"loc_per_day":169.6,"flagged":false},{"from":"1.0.0.beta.8","to":"1.0.0.rc.1","loc":235,"days":14.18,"loc_per_day":16.6,"flagged":false},{"from":"1.0.0.rc.1","to":"1.0.0.rc.2","loc":55,"days":4.81,"loc_per_day":11.4,"flagged":false},{"from":"1.0.0.rc.2","to":"1.0.0","loc":186,"days":5.66,"loc_per_day":32.9,"flagged":false},{"from":"1.0.0","to":"1.0.1","loc":695,"days":22.7,"loc_per_day":30.6,"flagged":false},{"from":"1.0.1","to":"1.1.0.beta.1","loc":4095,"days":39.28,"loc_per_day":104.2,"flagged":false},{"from":"1.1.0.beta.1","to":"1.1.0.beta.2","loc":525,"days":54.18,"loc_per_day":9.7,"flagged":false},{"from":"1.1.0.beta.2","to":"1.1.0.rc.1","loc":84,"days":7.0,"loc_per_day":12.0,"flagged":false},{"from":"1.1.0.rc.1","to":"1.1.0.rc.2","loc":112,"days":2.95,"loc_per_day":38.0,"flagged":false},{"from":"1.1.0.rc.2","to":"1.1.0.rc.3","loc":378,"days":27.88,"loc_per_day":13.6,"flagged":false},{"from":"1.1.0.rc.3","to":"1.1.0","loc":51,"days":8.13,"loc_per_day":6.3,"flagged":false},{"from":"1.1.0","to":"1.1.1","loc":9,"days":0.66,"loc_per_day":13.6,"flagged":false},{"from":"1.1.1","to":"1.2.0.beta.1","loc":219,"days":7.76,"loc_per_day":28.2,"flagged":false},{"from":"1.2.0.beta.1","to":"1.2.0.beta.3","loc":461,"days":61.52,"loc_per_day":7.5,"flagged":false},{"from":"1.2.0.beta.3","to":"1.2.0.rc.1","loc":27,"days":16.13,"loc_per_day":1.7,"flagged":false},{"from":"1.2.0.rc.1","to":"1.2.0","loc":74,"days":14.75,"loc_per_day":5.0,"flagged":false},{"from":"1.2.0","to":"1.2.1.beta.1","loc":353,"days":38.44,"loc_per_day":9.2,"flagged":false},{"from":"1.2.1.beta.1","to":"1.2.1.rc.1","loc":334,"days":28.68,"loc_per_day":11.6,"flagged":false},{"from":"1.2.1.rc.1","to":"1.2.1","loc":1,"days":5.99,"loc_per_day":0.2,"flagged":false},{"from":"1.2.1","to":"1.3.0.beta.1","loc":1560,"days":56.07,"loc_per_day":27.8,"flagged":false},{"from":"1.3.0.beta.1","to":"1.3.0.beta.2","loc":420,"days":16.08,"loc_per_day":26.1,"flagged":false},{"from":"1.3.0.beta.2","to":"1.3.0.beta.3","loc":808,"days":26.94,"loc_per_day":30.0,"flagged":false},{"from":"1.3.0.beta.3","to":"1.3.0.rc.1","loc":42,"days":8.18,"loc_per_day":5.1,"flagged":false},{"from":"1.3.0.rc.1","to":"1.3.0","loc":150,"days":5.82,"loc_per_day":25.8,"flagged":false},{"from":"1.3.0","to":"1.4.0.beta.1","loc":1439,"days":52.64,"loc_per_day":27.3,"flagged":false},{"from":"1.4.0.beta.1","to":"1.4.0.beta.2","loc":1456,"days":30.01,"loc_per_day":48.5,"flagged":false},{"from":"1.4.0.beta.2","to":"1.4.0.rc.1","loc":813,"days":53.47,"loc_per_day":15.2,"flagged":false},{"from":"1.4.0.rc.1","to":"1.4.0","loc":211,"days":33.06,"loc_per_day":6.4,"flagged":false},{"from":"1.4.0","to":"1.5.0.beta.1","loc":3164,"days":63.07,"loc_per_day":50.2,"flagged":false},{"from":"1.5.0.beta.1","to":"1.5.0","loc":36,"days":12.93,"loc_per_day":2.8,"flagged":false},{"from":"1.5.0","to":"1.5.1","loc":176,"days":32.27,"loc_per_day":5.5,"flagged":false},{"from":"1.5.1","to":"1.5.2","loc":1,"days":2.41,"loc_per_day":0.4,"flagged":false},{"from":"1.5.2","to":"1.5.3","loc":7,"days":15.61,"loc_per_day":0.4,"flagged":false},{"from":"1.5.3","to":"1.6.0.beta.1","loc":8630,"days":83.73,"loc_per_day":103.1,"flagged":false},{"from":"1.6.0.beta.1","to":"1.6.0.beta.2","loc":940,"days":61.76,"loc_per_day":15.2,"flagged":false},{"from":"1.6.0.beta.2","to":"1.6.0.rc.1","loc":259,"days":99.31,"loc_per_day":2.6,"flagged":false},{"from":"1.6.0.rc.1","to":"1.6.0.rc.2","loc":57,"days":4.71,"loc_per_day":12.1,"flagged":false},{"from":"1.6.0.rc.2","to":"1.6.0","loc":1,"days":8.25,"loc_per_day":0.1,"flagged":false},{"from":"1.6.0","to":"1.6.1","loc":15,"days":14.91,"loc_per_day":1.0,"flagged":false},{"from":"1.6.1","to":"1.7.0.beta.1","loc":8342,"days":0.82,"loc_per_day":10173.7,"flagged":false},{"from":"1.7.0.beta.1","to":"1.7.0.beta.2","loc":434,"days":14.21,"loc_per_day":30.5,"flagged":false},{"from":"1.7.0.beta.2","to":"1.7.0.beta.3","loc":349,"days":19.06,"loc_per_day":18.3,"flagged":false},{"from":"1.7.0.beta.3","to":"1.7.0.rc.1","loc":340,"days":35.83,"loc_per_day":9.5,"flagged":false},{"from":"1.7.0.rc.1","to":"1.6.2","loc":15,"days":12.82,"loc_per_day":1.2,"flagged":false},{"from":"1.6.2","to":"1.7.0.rc.2","loc":9550,"days":0.14,"loc_per_day":69765.8,"flagged":false},{"from":"1.7.0.rc.2","to":"1.7.0","loc":55,"days":6.85,"loc_per_day":8.0,"flagged":false},{"from":"1.7.0","to":"1.7.1","loc":62,"days":8.06,"loc_per_day":7.7,"flagged":false},{"from":"1.7.1","to":"1.7.2","loc":62,"days":14.24,"loc_per_day":4.4,"flagged":false},{"from":"1.7.2","to":"1.7.3","loc":4,"days":14.79,"loc_per_day":0.3,"flagged":false},{"from":"1.7.3","to":"1.7.4","loc":12,"days":11.12,"loc_per_day":1.1,"flagged":false},{"from":"1.7.4","to":"1.7.5","loc":48,"days":9.84,"loc_per_day":4.9,"flagged":false},{"from":"1.7.5","to":"1.8.0.beta.1","loc":4081,"days":16.85,"loc_per_day":242.2,"flagged":false},{"from":"1.8.0.beta.1","to":"1.8.0.beta.2","loc":90,"days":22.06,"loc_per_day":4.1,"flagged":false},{"from":"1.8.0.beta.2","to":"1.8.0","loc":236,"days":27.15,"loc_per_day":8.7,"flagged":false},{"from":"1.8.0","to":"1.8.1","loc":1,"days":3.83,"loc_per_day":0.3,"flagged":false},{"from":"1.8.1","to":"1.8.3","loc":12,"days":7.16,"loc_per_day":1.7,"flagged":false},{"from":"1.8.3","to":"1.8.4","loc":12,"days":11.88,"loc_per_day":1.0,"flagged":false},{"from":"1.8.4","to":"1.9.0.beta.1","loc":3121,"days":61.17,"loc_per_day":51.0,"flagged":false},{"from":"1.9.0.beta.1","to":"1.9.0.beta.2","loc":14,"days":1.07,"loc_per_day":13.0,"flagged":false},{"from":"1.9.0.beta.2","to":"1.9.0.beta.3","loc":187,"days":48.95,"loc_per_day":3.8,"flagged":false},{"from":"1.9.0.beta.3","to":"1.9.0","loc":69,"days":21.08,"loc_per_day":3.3,"flagged":false},{"from":"1.9.0","to":"1.9.1","loc":423,"days":13.0,"loc_per_day":32.5,"flagged":false},{"from":"1.9.1","to":"1.9.2","loc":1,"days":73.79,"loc_per_day":0.0,"flagged":false},{"from":"1.9.2","to":"1.9.3","loc":1,"days":7.09,"loc_per_day":0.1,"flagged":false},{"from":"1.9.3","to":"1.10.0.beta.1","loc":3671,"days":49.12,"loc_per_day":74.7,"flagged":false},{"from":"1.10.0.beta.1","to":"1.10.0.beta.2","loc":20,"days":25.77,"loc_per_day":0.8,"flagged":false},{"from":"1.10.0.beta.2","to":"1.10.0.rc.1","loc":61,"days":34.27,"loc_per_day":1.8,"flagged":false},{"from":"1.10.0.rc.1","to":"1.10.0","loc":1441,"days":34.81,"loc_per_day":41.4,"flagged":false},{"from":"1.10.0","to":"1.10.1","loc":897,"days":79.03,"loc_per_day":11.3,"flagged":false},{"from":"1.10.1","to":"1.10.2","loc":67,"days":202.07,"loc_per_day":0.3,"flagged":false},{"from":"1.10.2","to":"1.11.0.beta.1","loc":2331,"days":11.89,"loc_per_day":196.0,"flagged":false},{"from":"1.11.0.beta.1","to":"1.11.0.beta.2","loc":266,"days":2.17,"loc_per_day":122.7,"flagged":false},{"from":"1.11.0.beta.2","to":"1.11.0.rc.1","loc":4,"days":13.74,"loc_per_day":0.3,"flagged":false},{"from":"1.11.0.rc.1","to":"1.11.0","loc":1,"days":7.03,"loc_per_day":0.1,"flagged":false},{"from":"1.11.0","to":"1.11.1","loc":97,"days":11.35,"loc_per_day":8.5,"flagged":false},{"from":"1.11.1","to":"1.11.2","loc":26,"days":0.63,"loc_per_day":41.2,"flagged":false},{"from":"1.11.2","to":"1.11.3","loc":625,"days":183.42,"loc_per_day":3.4,"flagged":false},{"from":"1.11.3","to":"1.12.0","loc":845,"days":348.9,"loc_per_day":2.4,"flagged":false},{"from":"1.12.0","to":"1.12.1","loc":9,"days":49.88,"loc_per_day":0.2,"flagged":false},{"from":"1.12.1","to":"1.13.0","loc":206,"days":157.03,"loc_per_day":1.3,"flagged":false},{"from":"1.13.0","to":"1.14.0","loc":5,"days":33.34,"loc_per_day":0.1,"flagged":false},{"from":"1.14.0","to":"1.14.1","loc":1,"days":0.61,"loc_per_day":1.7,"flagged":false},{"from":"1.14.1","to":"1.14.2","loc":1,"days":0.2,"loc_per_day":4.9,"flagged":false},{"from":"1.14.2","to":"1.14.3","loc":1,"days":23.83,"loc_per_day":0.0,"flagged":false},{"from":"1.14.3","to":"1.15.0","loc":85,"days":69.84,"loc_per_day":1.2,"flagged":false},{"from":"1.15.0","to":"1.15.1","loc":5,"days":8.39,"loc_per_day":0.6,"flagged":false},{"from":"1.15.1","to":"1.15.2","loc":23,"days":0.63,"loc_per_day":36.5,"flagged":false},{"from":"1.15.2","to":"1.16.1","loc":3060,"days":266.04,"loc_per_day":11.5,"flagged":false},{"from":"1.16.1","to":"1.16.2","loc":2,"days":1.96,"loc_per_day":1.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":29819.0,"index":0.05,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.034,"files:narrated_steps":1.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":1.0,"per_kloc:emoji_in_code":0.034,"files:emoji_in_code":1.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: # First, wire up all resource bundles.","ref":"lib/cocoapods/installer/xcode/pods_project_generator/pod_target_dependency_installer.rb:40","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/lib/cocoapods/installer/xcode/pods_project_generator/pod_target_dependency_installer.rb#L40","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":11.0,"secrets_low_confidence":2.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"examples/GeneralExample/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"examples/GeneralExample/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"examples/TestInclusions/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"examples/TestInclusions/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"examples/Vendored Framework Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"examples/Vendored Framework Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"examples/HeaderMappingsDir Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"examples/HeaderMappingsDir Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in the current tree (test/docs/example file)","path":"examples/watchOS Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"examples/watchOS Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 4df00cba6f); removed from the current tree but still retrievable","path":"examples/AppCenter Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"4df00cba6f7796167d0081cba29b92940efbd324:examples/AppCenter Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 24315ed71a); removed from the current tree but still retrievable","path":"examples/AFNetworking Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"24315ed71a0bae14220b2377d6e82d30def83844:examples/AFNetworking Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 24315ed71a); removed from the current tree but still retrievable","path":"examples/Alamofire Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"24315ed71a0bae14220b2377d6e82d30def83844:examples/Alamofire Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 24315ed71a); removed from the current tree but still retrievable","path":"examples/Resource Bundle Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint","line":2,"fingerprint":"24315ed71a0bae14220b2377d6e82d30def83844:examples/Resource Bundle Example/Examples.xcworkspace/xcshareddata/Examples.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit a4898472e3); removed from the current tree but still retrievable","path":".travis.yml","line":29,"fingerprint":"a4898472e3df89a79f6cf6fce78292c90d88749f:.travis.yml:generic-api-key:29"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 17609a1925); removed from the current tree but still retrievable","path":"examples/watchOS Example/watchOSsample.xcworkspace/xcshareddata/watchOSsample.xcscmblueprint","line":2,"fingerprint":"17609a1925206dfc92b7b3b7abfcaa93b01ec07a:examples/watchOS Example/watchOSsample.xcworkspace/xcshareddata/watchOSsample.xcscmblueprint:generic-api-key:2"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit d87aa83526); removed from the current tree but still retrievable","path":"lib/cocoapods/command/push.rb","line":66,"fingerprint":"d87aa83526550f0eacb53788f53cbb0202554344:lib/cocoapods/command/push.rb:generic-api-key:66"},{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit 8a61d2db02); removed from the current tree but still retrievable","path":"examples/RKTwitter/Podfile.lock","line":51,"fingerprint":"8a61d2db029c3f5493935380a83cc9a3922f8f35:examples/RKTwitter/Podfile.lock:generic-api-key:51"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":14.0,"findings_high":3.0,"findings_medium":11.0,"findings_low":0.0,"weighted_findings":8.15,"scanned_lines":29002.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/ruby.lang.security.model-attributes-attr-accessible","severity":"high","message":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low]","path":"lib/cocoapods/resolver/lazy_specification.rb","line":5,"fingerprint":"ruby.lang.security.model-attributes-attr-accessible:lib/cocoapods/resolver/lazy_specification.rb:5"},{"rule_id":"opengrep/ruby.lang.security.model-attributes-attr-accessible","severity":"high","message":"Checks for models that do not use attr_accessible. This means there is no limiting of which variables can be manipulated through mass assignment. For newer Rails applications, parameters should be allowlisted using strong parameters. For older Rails versions, they should be allowlisted using strong_ [confidence low]","path":"lib/cocoapods/resolver/lazy_specification.rb","line":15,"fingerprint":"ruby.lang.security.model-attributes-attr-accessible:lib/cocoapods/resolver/lazy_specification.rb:15"},{"rule_id":"opengrep/ruby.lang.security.bad-deserialization-yaml","severity":"high","message":"Unsafe deserialization from YAML. Objects in Ruby can be serialized into strings, then later loaded from strings. However, uses of load and object_load can cause remote code execution. Loading user input with YAML can potentially be dangerous. Use JSON in a secure fashion instead. However, loading Y [confidence low]","path":"lib/cocoapods/sources_manager.rb","line":87,"fingerprint":"ruby.lang.security.bad-deserialization-yaml:lib/cocoapods/sources_manager.rb:87"},{"rule_id":"opengrep/ruby.lang.security.dangerous-subshell","severity":"medium","message":"Detected non-static command inside `...`. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence low]","path":"bin/sandbox-pod","line":126,"fingerprint":"ruby.lang.security.dangerous-subshell:bin/sandbox-pod:126"},{"rule_id":"opengrep/ruby.rails.security.audit.xss.manual-template-creation","severity":"medium","message":"Detected manual creation of an ERB template. Manual creation of templates may expose your application to server-side template injection (SSTI) or cross-site scripting (XSS) attacks if user input is used to create the template. Instead, create a '.erb' template file and use 'render'. [confidence low]","path":"bin/sandbox-pod","line":158,"fingerprint":"ruby.rails.security.audit.xss.manual-template-creation:bin/sandbox-pod:158"},{"rule_id":"opengrep/ruby.lang.security.dangerous-exec","severity":"medium","message":"Detected non-static command inside system. Audit the input to 'system'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code. [confidence medium]","path":"lib/cocoapods/config.rb","line":332,"fingerprint":"ruby.lang.security.dangerous-exec:lib/cocoapods/config.rb:332"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/cocoapods/downloader/request.rb","line":67,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/cocoapods/downloader/request.rb:67"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/cocoapods/installer/analyzer/pod_variant_set.rb","line":28,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/cocoapods/installer/analyzer/pod_variant_set.rb:28"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/cocoapods/installer/project_cache/target_cache_key.rb","line":133,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/cocoapods/installer/project_cache/target_cache_key.rb:133"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/cocoapods/installer/project_cache/target_cache_key.rb","line":136,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/cocoapods/installer/project_cache/target_cache_key.rb:136"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/cocoapods/installer/project_cache/target_cache_key.rb","line":139,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/cocoapods/installer/project_cache/target_cache_key.rb:139"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/cocoapods/installer/project_cache/target_cache_key.rb","line":183,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/cocoapods/installer/project_cache/target_cache_key.rb:183"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/cocoapods/installer/target_uuid_generator.rb","line":21,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/cocoapods/installer/target_uuid_generator.rb:21"},{"rule_id":"opengrep/ruby.lang.security.weak-hashes-md5","severity":"medium","message":"Should not use md5 to generate hashes. md5 is proven to be vulnerable through the use of brute-force attacks. Could also result in collisions, leading to potential collision attacks. Use SHA256 or other hashing functions instead. [confidence medium]","path":"lib/cocoapods/installer/target_uuid_generator.rb","line":23,"fingerprint":"ruby.lang.security.weak-hashes-md5:lib/cocoapods/installer/target_uuid_generator.rb:23"}],"evidence":[],"data":{"rulesets":["ruby","swift","c","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":4.0,"vulnerabilities":15.0,"vulns_critical":0.0,"vulns_high":2.0,"vulns_medium":11.0,"vulns_low":2.0,"vulns_unknown":0.0,"penalty":22.0},"findings":[{"rule_id":"osv/GHSA-8474-xrp6-wh69","severity":"high","message":"activesupport@6.1.7.10 (RubyGems) is affected by GHSA-8474-xrp6-wh69","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@6.1.7.10 (RubyGems):GHSA-8474-xrp6-wh69"},{"rule_id":"osv/GHSA-h8w8-99g7-qmvj","severity":"high","message":"concurrent-ruby@1.3.4 (RubyGems) is affected by GHSA-h8w8-99g7-qmvj","path":"Gemfile.lock","line":null,"fingerprint":"concurrent-ruby@1.3.4 (RubyGems):GHSA-h8w8-99g7-qmvj"},{"rule_id":"osv/GHSA-2j26-frm8-cmj9","severity":"medium","message":"activesupport@6.1.7.10 (RubyGems) is affected by GHSA-2j26-frm8-cmj9","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@6.1.7.10 (RubyGems):GHSA-2j26-frm8-cmj9"},{"rule_id":"osv/GHSA-89vf-4333-qx8v","severity":"medium","message":"activesupport@6.1.7.10 (RubyGems) is affected by GHSA-89vf-4333-qx8v","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@6.1.7.10 (RubyGems):GHSA-89vf-4333-qx8v"},{"rule_id":"osv/GHSA-cg4j-q9v8-6v38","severity":"medium","message":"activesupport@6.1.7.10 (RubyGems) is affected by GHSA-cg4j-q9v8-6v38","path":"Gemfile.lock","line":null,"fingerprint":"activesupport@6.1.7.10 (RubyGems):GHSA-cg4j-q9v8-6v38"},{"rule_id":"osv/GHSA-8gmh-2hhj-2hv9","severity":"medium","message":"addressable@2.9.0 (RubyGems) is affected by GHSA-8gmh-2hhj-2hv9","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.9.0 (RubyGems):GHSA-8gmh-2hhj-2hv9"},{"rule_id":"osv/GHSA-9crm-g4mf-wc5j","severity":"medium","message":"addressable@2.9.0 (RubyGems) is affected by GHSA-9crm-g4mf-wc5j","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.9.0 (RubyGems):GHSA-9crm-g4mf-wc5j"},{"rule_id":"osv/GHSA-9f42-57jx-vpp3","severity":"medium","message":"addressable@2.9.0 (RubyGems) is affected by GHSA-9f42-57jx-vpp3","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.9.0 (RubyGems):GHSA-9f42-57jx-vpp3"},{"rule_id":"osv/GHSA-j82w-28jv-3pmj","severity":"medium","message":"addressable@2.9.0 (RubyGems) is affected by GHSA-j82w-28jv-3pmj","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.9.0 (RubyGems):GHSA-j82w-28jv-3pmj"},{"rule_id":"osv/GHSA-qq38-m9mg-xjj5","severity":"medium","message":"addressable@2.9.0 (RubyGems) is affected by GHSA-qq38-m9mg-xjj5","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.9.0 (RubyGems):GHSA-qq38-m9mg-xjj5"},{"rule_id":"osv/GHSA-wv3x-4vxv-whpp","severity":"medium","message":"concurrent-ruby@1.3.4 (RubyGems) is affected by GHSA-wv3x-4vxv-whpp","path":"Gemfile.lock","line":null,"fingerprint":"concurrent-ruby@1.3.4 (RubyGems):GHSA-wv3x-4vxv-whpp"},{"rule_id":"osv/GHSA-3jfp-46x4-xgfj","severity":"medium","message":"yard@0.9.37 (RubyGems) is affected by GHSA-3jfp-46x4-xgfj","path":"Gemfile.lock","line":null,"fingerprint":"yard@0.9.37 (RubyGems):GHSA-3jfp-46x4-xgfj"},{"rule_id":"osv/GHSA-pxcc-8665-phx8","severity":"medium","message":"yard@0.9.37 (RubyGems) is affected by GHSA-pxcc-8665-phx8","path":"Gemfile.lock","line":null,"fingerprint":"yard@0.9.37 (RubyGems):GHSA-pxcc-8665-phx8"},{"rule_id":"osv/GHSA-539f-xcgw-2gjg","severity":"low","message":"addressable@2.9.0 (RubyGems) is affected by GHSA-539f-xcgw-2gjg","path":"Gemfile.lock","line":null,"fingerprint":"addressable@2.9.0 (RubyGems):GHSA-539f-xcgw-2gjg"},{"rule_id":"osv/GHSA-6wx8-w4f5-wwcr","severity":"low","message":"concurrent-ruby@1.3.4 (RubyGems) is affected by GHSA-6wx8-w4f5-wwcr","path":"Gemfile.lock","line":null,"fingerprint":"concurrent-ruby@1.3.4 (RubyGems):GHSA-6wx8-w4f5-wwcr"}],"evidence":[],"data":{"ecosystems":["RubyGems"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":3.0,"findings":15.0,"findings_high":10.0,"findings_medium":4.0,"findings_low":1.0,"penalty":128.2},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Lint.yml","line":20,"fingerprint":"unpinned-uses:.github/workflows/Lint.yml:20"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Lint.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/Lint.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Lint.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/Lint.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Lint.yml","line":43,"fingerprint":"unpinned-uses:.github/workflows/Lint.yml:43"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Specs.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/Specs.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Specs.yml","line":30,"fingerprint":"unpinned-uses:.github/workflows/Specs.yml:30"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Specs.yml","line":58,"fingerprint":"unpinned-uses:.github/workflows/Specs.yml:58"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Specs.yml","line":78,"fingerprint":"unpinned-uses:.github/workflows/Specs.yml:78"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/Specs.yml","line":88,"fingerprint":"unpinned-uses:.github/workflows/Specs.yml:88"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/issue-opened.yml","line":12,"fingerprint":"unpinned-uses:.github/workflows/issue-opened.yml:12"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/Lint.yml","line":19,"fingerprint":"artipacked:.github/workflows/Lint.yml:19"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/Lint.yml","line":4,"fingerprint":"excessive-permissions:.github/workflows/Lint.yml:4"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/Specs.yml","line":26,"fingerprint":"artipacked:.github/workflows/Specs.yml:26"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/Specs.yml","line":4,"fingerprint":"excessive-permissions:.github/workflows/Specs.yml:4"},{"rule_id":"zizmor/adhoc-packages","severity":"low","message":"ad-hoc installation of packages [confidence high]","path":".github/workflows/Specs.yml","line":71,"fingerprint":"adhoc-packages:.github/workflows/Specs.yml:71"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.045,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":1504.0,"function_nloc":11960.0,"mean_ccn":2.01,"p90_ccn":4.0,"complex_functions":3.0,"long_functions":1.0,"many_param_functions":9.0,"risky_nloc_share":0.0224},"findings":[],"evidence":[{"kind":"complex-function","description":"handle_resolver_error in lib/cocoapods/resolver.rb: complexity 23, 60 lines","ref":"lib/cocoapods/resolver.rb","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/lib/cocoapods/resolver.rb#L453","weight":0.38333333333333336},{"kind":"complex-function","description":"self.define_build_settings_method in lib/cocoapods/target/build_settings.rb: complexity 20, 31 lines","ref":"lib/cocoapods/target/build_settings.rb","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/lib/cocoapods/target/build_settings.rb#L100","weight":0.3333333333333333},{"kind":"complex-function","description":"section_title in lib/cocoapods/installer.rb: complexity 16, 66 lines","ref":"lib/cocoapods/installer.rb","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/lib/cocoapods/installer.rb#L549","weight":0.26666666666666666},{"kind":"complex-function","description":"report in lib/cocoapods/user_interface/error_report.rb: complexity 1, 111 lines","ref":"lib/cocoapods/user_interface/error_report.rb","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/lib/cocoapods/user_interface/error_report.rb#L11","weight":0.016666666666666666}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":18953.0,"duplicated_lines":1460.0,"duplicated_share":0.077,"files":369.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: examples/Excluded-Archs-Example/CoconutLib/CoconutLib/Coconut.h:1 and examples/Excluded-Archs-Example/CoconutLib/build/CoconutLib.xcframework/ios-arm64/CoconutLib.framework/Headers/Coconut.h:1","ref":"examples/Excluded-Archs-Example/CoconutLib/CoconutLib/Coconut.h","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/Excluded-Archs-Example/CoconutLib/CoconutLib/Coconut.h#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/Excluded-Archs-Example/CoconutLib/CoconutLib/CoconutLib.h:1 and examples/Excluded-Archs-Example/CoconutLib/build/CoconutLib.xcframework/ios-arm64/CoconutLib.framework/Headers/CoconutLib.h:1","ref":"examples/Excluded-Archs-Example/CoconutLib/CoconutLib/CoconutLib.h","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/Excluded-Archs-Example/CoconutLib/CoconutLib/CoconutLib.h#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/Excluded-Archs-Example/CoconutLib/build.sh:1 and examples/Oddly-Named-XCF-Slices-Example/CoconutLib/build.sh:1","ref":"examples/Excluded-Archs-Example/CoconutLib/build.sh","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/Excluded-Archs-Example/CoconutLib/build.sh#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/Excluded-Archs-Example/CoconutLib/build.sh:25 and examples/Vendored-XCFramework12-Example/CoconutLib/build.sh:31","ref":"examples/Excluded-Archs-Example/CoconutLib/build.sh","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/Excluded-Archs-Example/CoconutLib/build.sh#L25","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/Excluded-Archs-Example/archiveAndValidate.sh:1 and examples/Oddly-Named-XCF-Slices-Example/archiveAndValidate.sh:1","ref":"examples/Excluded-Archs-Example/archiveAndValidate.sh","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/Excluded-Archs-Example/archiveAndValidate.sh#L1","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/Excluded-Archs-Example/archiveAndValidate.sh:3 and examples/Vendored-XCFramework12-Example/archiveAndValidate.sh:3","ref":"examples/Excluded-Archs-Example/archiveAndValidate.sh","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/Excluded-Archs-Example/archiveAndValidate.sh#L3","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/GeneralExample/Example/AppDelegate.swift:4 and examples/GeneralExample/Example/DetailViewController.swift:4","ref":"examples/GeneralExample/Example/AppDelegate.swift","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/GeneralExample/Example/AppDelegate.swift#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/HeaderMappingsDir Example/HeaderMappingsDir Example/AppDelegate.swift:5 and examples/Headers Example/Headers Example/AppDelegate.swift:5","ref":"examples/HeaderMappingsDir Example/HeaderMappingsDir Example/AppDelegate.swift","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/HeaderMappingsDir Example/HeaderMappingsDir Example/AppDelegate.swift#L5","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/Modules Example/Static Swift/AppDelegate.swift:4 and examples/multiple test specs Example/InstallMultipleTestSpecs/AppDelegate.swift:11","ref":"examples/Modules Example/Static Swift/AppDelegate.swift","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/Modules Example/Static Swift/AppDelegate.swift#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: examples/MultiXcodeProject Example/MultiXcodeProjFrameworks/AppDelegate.m:6 and examples/MultiXcodeProject Example/MultiXcodeProject/AppDelegate.m:6","ref":"examples/MultiXcodeProject Example/MultiXcodeProjFrameworks/AppDelegate.m","url":"https://github.com/CocoaPods/CocoaPods/blob/b80e113e28a7e23cd6dbc169f0c923f6b48bf7a2/examples/MultiXcodeProject Example/MultiXcodeProjFrameworks/AppDelegate.m#L6","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":29002.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":1.0,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":1.0,"test_lines":33453.0,"source_lines":29819.0,"test_ratio":1.1219,"ci_files":3.0,"cochange_share":0.3039,"cochange_commits":102.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/Lint.yml","ref":".github/workflows/Lint.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/Specs.yml","ref":".github/workflows/Specs.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/issue-opened.yml","ref":".github/workflows/issue-opened.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":67.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null}],"flags":[]}