{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-5+qual-2+sec-2","generated_at":"2026-11-14T15:57:42.804606Z","repo":{"ref":{"host":"github.com","owner":"JetBrains","name":"compose-multiplatform"},"default_branch":"master","clone_url":"https://github.com/JetBrains/compose-multiplatform.git","html_url":"https://github.com/JetBrains/compose-multiplatform","description":"Compose Multiplatform, a modern UI framework for Kotlin that makes building performant and beautiful user interfaces easy and enjoyable.","stars":19487,"forks":1435,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":289876,"primary_language":"Kotlin","license_spdx":"Apache-2.0","created_at":"2020-09-07T10:40:49Z","pushed_at":"2026-11-13T13:23:23Z","security_policy_url":"https://github.com/JetBrains/compose-multiplatform/security/policy","distribution":{"owner_created_at":"2011-06-27T10:06:52Z","owner_type":"Organization","release_assets":[]}},"commit_sha":"8431de3fdab6251ce5a0d7ab07303f5c85b13827","profile":{"lines_by_language":{"Kotlin":206035,"Swift":1015,"Shell":783,"JavaScript":343,"Java":45},"files_by_category":{"source":1554,"other":329,"test":253,"binary":246,"config":236,"docs":124,"oversized":10,"vendored":8,"generated":8},"source_lines":169381,"test_lines":38840},"pillars":{"ai_provenance":{"score":0.1,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0005,"suspected_share":0.0052,"estimated_share":0.0005,"ai_artifacts":0.0,"flagged_work_units":3.0,"flagged_releases":0.0,"style_index":0.248},"summary":"Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals."},"quality":{"score":67.9,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":83.5,"duplication":14.5,"lint":98.6,"testing":56.2,"docs":100.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.23, no CI test run detected; 6% of function code in complex or long functions; 32% duplicated lines. Weakest area: duplication."},"security":{"score":61.1,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":96.7,"sast":98.4,"dependencies":25.5,"ci_actions":0.1,"posture":60.0,"scorecard":null},"summary":"Security posture is weak: 29 known vulnerabilities in 13 dependencies; 30 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":2804.0,"attributed_commits":3.0,"attributed_commit_share":0.0010699001426533524,"effective_loc":1678247.0,"attributed_loc":840.0,"attributed_loc_share":0.000500522271155557,"tools_detected":2.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"OpenAI Codex: 2 attributed commits, 699 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Claude Code: 1 attributed commits, 141 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"8431de3fdab6251ce5a0d7ab07303f5c85b13827","url":"https://github.com/JetBrains/compose-multiplatform/commit/8431de3fdab6251ce5a0d7ab07303f5c85b13827","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: trailer 'Co-authored-by: Codex'","ref":"7a793b012376d3dbc25f2ae3f40e41423bd07386","url":"https://github.com/JetBrains/compose-multiplatform/commit/7a793b012376d3dbc25f2ae3f40e41423bd07386","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"8ebd34efd881bfa9101cc81083ce5182b5fdc0e7","url":"https://github.com/JetBrains/compose-multiplatform/commit/8ebd34efd881bfa9101cc81083ce5182b5fdc0e7","weight":0.9}],"data":{"attributed_loc_by_commit":{"8ebd34efd881bfa9101cc81083ce5182b5fdc0e7":141,"7a793b012376d3dbc25f2ae3f40e41423bd07386":157,"8431de3fdab6251ce5a0d7ab07303f5c85b13827":542},"tools":{"claude-code":{"name":"Claude Code","commits":1,"loc":141,"first_seen":1780564160,"last_seen":1780564160},"openai-codex":{"name":"OpenAI Codex","commits":2,"loc":699,"first_seen":1789586292,"last_seen":1794336164}},"monthly":{"2020-09":{"loc":6179,"attributed_loc":0},"2020-10":{"loc":6268,"attributed_loc":0},"2020-11":{"loc":1795,"attributed_loc":0},"2020-12":{"loc":4121,"attributed_loc":0},"2021-01":{"loc":1446,"attributed_loc":0},"2021-02":{"loc":3523,"attributed_loc":0},"2021-03":{"loc":1518,"attributed_loc":0},"2021-04":{"loc":1402,"attributed_loc":0},"2021-05":{"loc":14761,"attributed_loc":0},"2021-06":{"loc":13277,"attributed_loc":0},"2021-07":{"loc":13113,"attributed_loc":0},"2021-08":{"loc":5627,"attributed_loc":0},"2021-09":{"loc":871,"attributed_loc":0},"2021-10":{"loc":3663,"attributed_loc":0},"2021-11":{"loc":3755,"attributed_loc":0},"2021-12":{"loc":2043,"attributed_loc":0},"2022-01":{"loc":4399,"attributed_loc":0},"2022-02":{"loc":2480,"attributed_loc":0},"2022-03":{"loc":1904,"attributed_loc":0},"2022-04":{"loc":1389,"attributed_loc":0},"2022-05":{"loc":278,"attributed_loc":0},"2022-06":{"loc":143,"attributed_loc":0},"2022-07":{"loc":752,"attributed_loc":0},"2022-08":{"loc":6,"attributed_loc":0},"2022-09":{"loc":1952,"attributed_loc":0},"2022-10":{"loc":1449,"attributed_loc":0},"2022-11":{"loc":9374,"attributed_loc":0},"2022-12":{"loc":5321,"attributed_loc":0},"2023-01":{"loc":1965,"attributed_loc":0},"2023-02":{"loc":3596,"attributed_loc":0},"2023-03":{"loc":6355,"attributed_loc":0},"2023-04":{"loc":3875,"attributed_loc":0},"2023-05":{"loc":3273,"attributed_loc":0},"2023-06":{"loc":66,"attributed_loc":0},"2023-07":{"loc":1528,"attributed_loc":0},"2023-08":{"loc":2524,"attributed_loc":0},"2023-09":{"loc":2008,"attributed_loc":0},"2023-10":{"loc":911,"attributed_loc":0},"2023-11":{"loc":2097,"attributed_loc":0},"2023-12":{"loc":2210,"attributed_loc":0},"2024-01":{"loc":1823,"attributed_loc":0},"2024-02":{"loc":1104319,"attributed_loc":0},"2024-03":{"loc":256562,"attributed_loc":0},"2024-04":{"loc":4054,"attributed_loc":0},"2024-05":{"loc":10789,"attributed_loc":0},"2024-06":{"loc":681,"attributed_loc":0},"2024-07":{"loc":2018,"attributed_loc":0},"2024-08":{"loc":785,"attributed_loc":0},"2024-09":{"loc":745,"attributed_loc":0},"2024-10":{"loc":341,"attributed_loc":0},"2024-11":{"loc":659,"attributed_loc":0},"2024-12":{"loc":1433,"attributed_loc":0},"2025-01":{"loc":4144,"attributed_loc":0},"2025-02":{"loc":472,"attributed_loc":0},"2025-03":{"loc":889,"attributed_loc":0},"2025-04":{"loc":2010,"attributed_loc":0},"2025-05":{"loc":19960,"attributed_loc":0},"2025-06":{"loc":417,"attributed_loc":0},"2025-07":{"loc":1404,"attributed_loc":0},"2025-08":{"loc":1880,"attributed_loc":0},"2025-09":{"loc":163,"attributed_loc":0},"2025-10":{"loc":1931,"attributed_loc":0},"2025-11":{"loc":684,"attributed_loc":0},"2025-12":{"loc":264,"attributed_loc":0},"2026-01":{"loc":290,"attributed_loc":0},"2026-02":{"loc":794,"attributed_loc":0},"2026-03":{"loc":2568,"attributed_loc":0},"2026-04":{"loc":408,"attributed_loc":0},"2026-05":{"loc":900,"attributed_loc":0},"2026-06":{"loc":1745,"attributed_loc":141},"2026-07":{"loc":3700,"attributed_loc":0},"2026-08":{"loc":41303,"attributed_loc":0},"2026-09":{"loc":43377,"attributed_loc":157},"2026-10":{"loc":20862,"attributed_loc":0},"2026-11":{"loc":656,"attributed_loc":542}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"work_units":1609.0,"flagged_units":3.0,"pre_ai_era_bursts":2.0,"pre_ai_era_measured_loc":38705.0,"pre_ai_era_burst_loc":3824.0,"measured_loc":227559.0,"flagged_loc":8775.0,"flagged_loc_share":0.03856142802525939,"max_loc_per_hour":2451.008645533141,"median_loc_per_hour":14.742246962242682,"pr_timed_units":1148.0,"excluded_import_loc":1450688.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,121 lines of first-party code in ~1.6h (1,354 lines/hour, PR #5781)","ref":"57dffdc7a7f4d51b09a2293a3d0d6aec9aa0960d","url":"https://github.com/JetBrains/compose-multiplatform/commit/57dffdc7a7f4d51b09a2293a3d0d6aec9aa0960d","weight":0.40614893617021275},{"kind":"velocity-burst","description":"3,680 lines of first-party code in ~4.8h (763 lines/hour, PR #2500)","ref":"e8786ea73fbdf67be9be57d54377fd7008486b20","url":"https://github.com/JetBrains/compose-multiplatform/commit/e8786ea73fbdf67be9be57d54377fd7008486b20","weight":0.2288478148212126},{"kind":"velocity-burst","description":"2,974 lines of first-party code in ~4.0h (744 lines/hour, 1 commit session)","ref":"6fa567032e56f98dc050e8bd4d2cee25221a915e","url":"https://github.com/JetBrains/compose-multiplatform/commit/6fa567032e56f98dc050e8bd4d2cee25221a915e","weight":0.22305}],"data":{"flagged_loc_by_commit":{"6fa567032e56f98dc050e8bd4d2cee25221a915e":2974,"e8786ea73fbdf67be9be57d54377fd7008486b20":3680,"57dffdc7a7f4d51b09a2293a3d0d6aec9aa0960d":2121},"excluded_import_commits":["7be1e313690d6d3a14d07ed2f5cfdd551edf52e3","8ad5473ea5d0cfeffa9cd648785cc19b1c4b8e6a","a73f8fa7c9ff9dbe8d2717fdab2c9faee8973106","b35c49fbe87e64304de66d9eea260921ca284792","c3dc2c28db00e5100ec39eb9e0f4523104a9ca51","ca3ae45516977266a0b0ecb5b290f9ebf8bf2587","cc0e18474a26dd839d36f6df13fdf5b6325e91dc","d5b0e9fa0e94455ef09bd6ce903344eb917db04f","da9b1e1a29b10e44ac84b081c32b8803e20719e7","f201961e31924ee7109d8e00c6a40670e21e5597","f4987d0ce9de21559233a3cf156e27db512f254a"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-5","metrics":{"releases":99.0,"flagged_releases":0.0,"max_loc_per_day":5753.0},"findings":[],"evidence":[],"data":{"releases":[{"from":"v1.12.0-beta01+dev4339","to":"v1.12.0-beta02+dev4388","loc":0,"days":4.94,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.0-beta02+dev4388","to":"v1.12.0-beta02+dev4397","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.0-beta02+dev4397","to":"v1.12.0-beta02+dev4402","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.0-beta02+dev4402","to":"v1.12.10-alpha01+dev4389","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4389","to":"v1.12.10-alpha01+dev4396","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4396","to":"v1.12.10-alpha01+dev4403","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4403","to":"v1.12.10-alpha01+dev4413","loc":10,"days":6.11,"loc_per_day":1.6,"flagged":false},{"from":"v1.12.10-alpha01+dev4413","to":"v1.12.10-alpha01+dev4419","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4419","to":"v1.12.10-alpha01+dev4434","loc":87,"days":0.85,"loc_per_day":102.3,"flagged":false},{"from":"v1.12.10-alpha01+dev4434","to":"v1.12.10-alpha01+dev4438","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4438","to":"v1.12.10-alpha01+dev4443","loc":0,"days":2.18,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4443","to":"v1.12.10-alpha01+dev4447","loc":46,"days":1.04,"loc_per_day":44.4,"flagged":false},{"from":"v1.12.10-alpha01+dev4447","to":"v1.12.10-alpha01+dev4462","loc":6,"days":3.3,"loc_per_day":1.8,"flagged":false},{"from":"v1.12.10-alpha01+dev4462","to":"v1.12.10-alpha01+dev4472","loc":2,"days":0.62,"loc_per_day":3.2,"flagged":false},{"from":"v1.12.10-alpha01+dev4472","to":"v1.12.10-alpha01+dev4484","loc":113,"days":1.16,"loc_per_day":97.6,"flagged":false},{"from":"v1.12.10-alpha01+dev4484","to":"v1.12.10-alpha01+dev4492","loc":68,"days":0.76,"loc_per_day":89.5,"flagged":false},{"from":"v1.12.10-alpha01+dev4492","to":"v1.12.10-alpha01+dev4500","loc":795,"days":3.93,"loc_per_day":202.5,"flagged":false},{"from":"v1.12.10-alpha01+dev4500","to":"v1.12.10-alpha01+dev4519","loc":28,"days":1.03,"loc_per_day":27.3,"flagged":false},{"from":"v1.12.10-alpha01+dev4519","to":"v1.12.10-alpha01+dev4525","loc":801,"days":0.19,"loc_per_day":4138.6,"flagged":false},{"from":"v1.12.10-alpha01+dev4525","to":"v1.12.10-alpha01+dev4534","loc":84,"days":0.68,"loc_per_day":123.3,"flagged":false},{"from":"v1.12.10-alpha01+dev4534","to":"v1.12.10-alpha01+dev4541","loc":9,"days":1.12,"loc_per_day":8.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4541","to":"v1.12.10-alpha01+dev4546","loc":138,"days":1.12,"loc_per_day":122.8,"flagged":false},{"from":"v1.12.10-alpha01+dev4546","to":"v1.12.10-alpha01+dev4557","loc":20,"days":2.89,"loc_per_day":6.9,"flagged":false},{"from":"v1.12.10-alpha01+dev4557","to":"v1.12.10-alpha01+dev4576","loc":1260,"days":3.03,"loc_per_day":415.8,"flagged":false},{"from":"v1.12.10-alpha01+dev4576","to":"v1.12.10-alpha01+dev4579","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4579","to":"v1.12.10-alpha01+dev4583","loc":233,"days":0.95,"loc_per_day":244.5,"flagged":false},{"from":"v1.12.10-alpha01+dev4583","to":"v1.12.10-alpha01+dev4589","loc":0,"days":0.21,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4589","to":"v1.12.10-alpha01+dev4593","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4593","to":"v1.12.10-alpha01+dev4595","loc":37,"days":4.05,"loc_per_day":9.1,"flagged":false},{"from":"v1.12.10-alpha01+dev4595","to":"v1.12.10-alpha01+dev4597","loc":24,"days":0.12,"loc_per_day":192.4,"flagged":false},{"from":"v1.12.10-alpha01+dev4597","to":"v1.12.10-alpha01+dev4599","loc":4,"days":0.52,"loc_per_day":7.7,"flagged":false},{"from":"v1.12.10-alpha01+dev4599","to":"v1.12.10-alpha01+dev4602","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4602","to":"v1.12.10-alpha01+dev4604","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4604","to":"v1.12.10-alpha01+dev4606","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4606","to":"v1.12.10-alpha01+dev4611","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4611","to":"v1.12.10-alpha01+dev4613","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4613","to":"v1.12.10-alpha01+dev4616","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4616","to":"v1.12.10-alpha01+dev4617","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4617","to":"v1.12.10-alpha01+dev4627","loc":295,"days":5.54,"loc_per_day":53.2,"flagged":false},{"from":"v1.12.10-alpha01+dev4627","to":"v1.12.10-alpha01+dev4632","loc":0,"days":0.53,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4632","to":"v1.12.10-alpha01+dev4637","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4637","to":"v1.12.10-alpha01+dev4641","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4641","to":"v1.12.10-alpha01+dev4642","loc":161,"days":3.08,"loc_per_day":52.3,"flagged":false},{"from":"v1.12.10-alpha01+dev4642","to":"v1.12.10-alpha01+dev4648","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4648","to":"v1.12.10-alpha01+dev4653","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4653","to":"v1.12.10-alpha01+dev4661","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4661","to":"v1.12.10-alpha01+dev4666","loc":14,"days":5.08,"loc_per_day":2.8,"flagged":false},{"from":"v1.12.10-alpha01+dev4666","to":"v1.12.10-alpha01+dev4668","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4668","to":"v1.12.10-alpha01+dev4672","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4672","to":"v1.12.10-alpha01+dev4677","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4677","to":"v1.12.10-alpha01+dev4686","loc":172,"days":5.96,"loc_per_day":28.9,"flagged":false},{"from":"v1.12.10-alpha01+dev4686","to":"v1.12.10-alpha01+dev4698","loc":1,"days":1.01,"loc_per_day":1.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4698","to":"v1.12.10-alpha01+dev4704","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4704","to":"v1.12.10-alpha01+dev4710","loc":0,"days":1.94,"loc_per_day":0.0,"flagged":false},{"from":"v1.12.10-alpha01+dev4710","to":"v1.13.0-alpha01+dev4724","loc":4,"days":3.3,"loc_per_day":1.2,"flagged":false},{"from":"v1.13.0-alpha01+dev4724","to":"v1.13.0-alpha01","loc":2,"days":0.57,"loc_per_day":3.5,"flagged":false},{"from":"v1.13.0-alpha01","to":"v1.13.0-alpha01+dev4730","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha01+dev4730","to":"v1.13.0-alpha01+dev4739","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha01+dev4739","to":"v1.13.0-alpha01+dev4741","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha01+dev4741","to":"v1.13.0-alpha01+dev4764","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha01+dev4764","to":"v1.13.0-alpha01+dev4743","loc":1,"days":0.94,"loc_per_day":1.1,"flagged":false},{"from":"v1.13.0-alpha01+dev4743","to":"v1.13.0-alpha01+dev4746","loc":95,"days":0.16,"loc_per_day":577.1,"flagged":false},{"from":"v1.13.0-alpha01+dev4746","to":"v1.13.0-alpha01+dev4749","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha01+dev4749","to":"v1.13.0-alpha01+dev4754","loc":0,"days":1.93,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha01+dev4754","to":"v1.13.0-alpha01+dev4762","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha01+dev4762","to":"v1.13.0-alpha01+dev4775","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha01+dev4775","to":"v1.13.0-alpha02+dev4828","loc":11272,"days":12.37,"loc_per_day":911.1,"flagged":false},{"from":"v1.13.0-alpha02+dev4828","to":"v1.13.0-alpha02+dev4832","loc":3166,"days":0.55,"loc_per_day":5753.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4832","to":"v1.13.0-alpha02+dev4836","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4836","to":"v1.13.0-alpha02+dev4841","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4841","to":"v1.13.0-alpha02+dev4847","loc":60,"days":1.16,"loc_per_day":51.6,"flagged":false},{"from":"v1.13.0-alpha02+dev4847","to":"v1.13.0-alpha02+dev4853","loc":1331,"days":2.94,"loc_per_day":453.4,"flagged":false},{"from":"v1.13.0-alpha02+dev4853","to":"v1.13.0-alpha02+dev4857","loc":4,"days":1.23,"loc_per_day":3.3,"flagged":false},{"from":"v1.13.0-alpha02+dev4857","to":"v1.13.0-alpha02+dev4861","loc":727,"days":0.83,"loc_per_day":873.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4861","to":"v1.13.0-alpha02+dev4869","loc":1129,"days":1.13,"loc_per_day":998.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4869","to":"v1.13.0-alpha02+dev4872","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4872","to":"v1.13.0-alpha02+dev4880","loc":311,"days":1.02,"loc_per_day":305.1,"flagged":false},{"from":"v1.13.0-alpha02+dev4880","to":"v1.13.0-alpha02+dev4885","loc":754,"days":2.94,"loc_per_day":256.2,"flagged":false},{"from":"v1.13.0-alpha02+dev4885","to":"v1.13.0-alpha02","loc":4,"days":0.95,"loc_per_day":4.2,"flagged":false},{"from":"v1.13.0-alpha02","to":"v1.13.0-alpha02+dev4895","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4895","to":"v1.13.0-alpha02+dev4899","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4899","to":"v1.13.0-alpha02+dev4905","loc":978,"days":1.05,"loc_per_day":929.4,"flagged":false},{"from":"v1.13.0-alpha02+dev4905","to":"v1.13.0-alpha02+dev4909","loc":146,"days":0.97,"loc_per_day":151.1,"flagged":false},{"from":"v1.13.0-alpha02+dev4909","to":"v1.13.0-alpha02+dev4912","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-alpha02+dev4912","to":"v1.13.0-alpha02+dev4917","loc":1102,"days":3.94,"loc_per_day":279.4,"flagged":false},{"from":"v1.13.0-alpha02+dev4917","to":"buildHelpers_v0.1.1","loc":3559,"days":9.85,"loc_per_day":361.2,"flagged":false},{"from":"buildHelpers_v0.1.1","to":"buildHelpers_v0.1.2","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"buildHelpers_v0.1.2","to":"v1.13.0-beta01+dev5005","loc":0,"days":0.12,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.0-beta01+dev5005","to":"v1.13.10-alpha01+dev5006","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.10-alpha01+dev5006","to":"v1.13.10-alpha01+dev5018","loc":574,"days":1.09,"loc_per_day":529.0,"flagged":false},{"from":"v1.13.10-alpha01+dev5018","to":"v1.13.10-alpha01+dev5041","loc":909,"days":5.88,"loc_per_day":154.7,"flagged":false},{"from":"v1.13.10-alpha01+dev5041","to":"v1.13.10-alpha01+dev5090","loc":2232,"days":7.43,"loc_per_day":300.4,"flagged":false},{"from":"v1.13.10-alpha01+dev5090","to":"v1.13.10-alpha01+dev5098","loc":2441,"days":0.77,"loc_per_day":3184.1,"flagged":false},{"from":"v1.13.10-alpha01+dev5098","to":"v1.13.10-alpha01+dev5102","loc":0,"days":2.78,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.10-alpha01+dev5102","to":"v1.13.10-alpha01+dev5111","loc":25,"days":1.2,"loc_per_day":20.8,"flagged":false},{"from":"v1.13.10-alpha01+dev5111","to":"v1.13.10-alpha01+dev5124","loc":0,"days":0.94,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.10-alpha01+dev5124","to":"v1.13.10-alpha01+dev5165","loc":631,"days":6.21,"loc_per_day":101.7,"flagged":false},{"from":"v1.13.10-alpha01+dev5165","to":"v1.13.10-alpha01+dev5171","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false},{"from":"v1.13.10-alpha01+dev5171","to":"v1.13.10-alpha01+dev5175","loc":0,"days":0.04,"loc_per_day":0.0,"flagged":false}]},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":169381.0,"index":0.248,"count:narrated_steps":1.0,"per_kloc:narrated_steps":0.006,"files:narrated_steps":1.0,"count:placeholder":1.0,"per_kloc:placeholder":0.006,"files:placeholder":1.0,"count:emoji_in_code":78.0,"per_kloc:emoji_in_code":0.461,"files:emoji_in_code":29.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // now we can remove the root of the composition.","ref":"examples/html/compose-in-js/src/jsMain/resources/use_compose.js:29","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/examples/html/compose-in-js/src/jsMain/resources/use_compose.js#L29","weight":0.0},{"kind":"stylometry:placeholder","description":"placeholder or demo-only phrasing: \"You might need to replace currentOs with these explicit dependencies:\\n\" +","ref":"gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/ComposePlugin.kt:140","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/ComposePlugin.kt#L140","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":1.0},"findings":[{"rule_id":"gitleaks/generic-api-key","severity":"low","message":"Possible generic-api-key secret in history (commit b7cdad725c); removed from the current tree but still retrievable","path":"private/src/main/kotlin/androidx/build/FtlRunner.kt","line":126,"fingerprint":"b7cdad725c4942a58b18c93ede049b6a601f5334:private/src/main/kotlin/androidx/build/FtlRunner.kt:generic-api-key:126"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":24.0,"findings_high":0.0,"findings_medium":23.0,"findings_low":1.0,"weighted_findings":7.912,"scanned_lines":169381.0,"parse_errors":24.0},"findings":[{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"benchmarks/multiplatform/benchmarks/androidApp/src/main/AndroidManifest.xml","line":8,"fingerprint":"java.android.security.exported_activity:benchmarks/multiplatform/benchmarks/androidApp/src/main/AndroidManifest.xml:8"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"benchmarks/showcases/LazyGridImageView/composeApp/src/androidMain/AndroidManifest.xml","line":11,"fingerprint":"java.android.security.exported_activity:benchmarks/showcases/LazyGridImageView/composeApp/src/androidMain/AndroidManifest.xml:11"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"benchmarks/showcases/LazyGridImageView/nativeAndroidApp/app/src/main/AndroidManifest.xml","line":15,"fingerprint":"java.android.security.exported_activity:benchmarks/showcases/LazyGridImageView/nativeAndroidApp/app/src/main/AndroidManifest.xml:15"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"ci/templates/multiplatform-template/android/src/main/AndroidManifest.xml","line":11,"fingerprint":"java.android.security.exported_activity:ci/templates/multiplatform-template/android/src/main/AndroidManifest.xml:11"},{"rule_id":"opengrep/java.android.security.exported_activity","severity":"medium","message":"The application exports an activity. Any application on the device can launch the exported activity which may compromise the integrity of your application or its data.  Ensure that any exported activities do not have privileged access to your application's control plane. [confidence medium]","path":"components/resources/demo/androidApp/src/main/AndroidManifest.xml","line":9,"fingerprint":"java.android.security.exported_activity:components/resources/demo/androidApp/src/main/AndroidManifest.xml:9"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":14,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:14"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":15,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:15"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":22,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:22"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":25,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:25"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":26,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:26"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":27,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:27"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":28,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:28"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":29,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:29"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":30,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:30"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":31,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:31"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":32,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:32"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":33,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:33"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":35,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:35"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":36,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:36"},{"rule_id":"opengrep/javascript.lang.security.audit.path-traversal.path-join-resolve-traversal","severity":"medium","message":"Detected possible user input going into a `path.join` or `path.resolve` function. This could possibly lead to a path traversal vulnerability,  where the attacker can access arbitrary files stored in the file system. Instead, be sure to sanitize or validate user input first. [confidence low]","path":"components/resources/library/karma.config.d/config.js","line":42,"fingerprint":"javascript.lang.security.audit.path-traversal.path-join-resolve-traversal:components/resources/library/karma.config.d/config.js:42"},{"rule_id":"opengrep/kotlin.lang.security.use-of-md5","severity":"medium","message":"Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead. [confidence medium]","path":"gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/internal/files/fileUtils.kt","line":31,"fingerprint":"kotlin.lang.security.use-of-md5:gradle-plugins/compose/src/main/kotlin/org/jetbrains/compose/desktop/application/internal/files/fileUtils.kt:31"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"gradle-plugins/preview-rpc/src/main/kotlin/org/jetbrains/compose/desktop/ui/tooling/preview/rpc/utils.kt","line":22,"fingerprint":"kotlin.lang.security.unencrypted-socket:gradle-plugins/preview-rpc/src/main/kotlin/org/jetbrains/compose/desktop/ui/tooling/preview/rpc/utils.kt:22"},{"rule_id":"opengrep/kotlin.lang.security.unencrypted-socket","severity":"medium","message":"This socket is not encrypted. The traffic could be read by an attacker intercepting the network traffic. Use an SSLSocket created by 'SSLSocketFactory' or 'SSLServerSocketFactory' instead [confidence low]","path":"gradle-plugins/preview-rpc/src/main/kotlin/org/jetbrains/compose/desktop/ui/tooling/preview/rpc/utils.kt","line":35,"fingerprint":"kotlin.lang.security.unencrypted-socket:gradle-plugins/preview-rpc/src/main/kotlin/org/jetbrains/compose/desktop/ui/tooling/preview/rpc/utils.kt:35"},{"rule_id":"opengrep/javascript.lang.security.audit.unsafe-formatstring","severity":"low","message":"Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string. [confidence low]","path":"benchmarks/multiplatform/benchmarks/src/webMain/resources/polyfills.mjs","line":89,"fingerprint":"javascript.lang.security.audit.unsafe-formatstring:benchmarks/multiplatform/benchmarks/src/webMain/resources/polyfills.mjs:89"}],"evidence":[],"data":{"rulesets":["kotlin","swift","bash","javascript","java","dockerfile"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":13.0,"vulnerabilities":29.0,"vulns_critical":0.0,"vulns_high":14.0,"vulns_medium":11.0,"vulns_low":4.0,"vulns_unknown":0.0,"penalty":82.0},"findings":[{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-6j4f-fj2g-mc7p; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-qhr7-859c-m2p7; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-2883-xcg3-v3hh","severity":"high","message":"js-yaml@4.3.1 (npm) is affected by GHSA-2883-xcg3-v3hh; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"js-yaml@4.3.1 (npm):GHSA-2883-xcg3-v3hh"},{"rule_id":"osv/GHSA-5c6j-r48x-rmvq","severity":"high","message":"serialize-javascript@6.0.2 (npm) is affected by GHSA-5c6j-r48x-rmvq; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"serialize-javascript@6.0.2 (npm):GHSA-5c6j-r48x-rmvq"},{"rule_id":"osv/GHSA-27r3-jxmh-p828","severity":"high","message":"body-parser@1.20.6 (npm) is affected by GHSA-27r3-jxmh-p828","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"body-parser@1.20.6 (npm):GHSA-27r3-jxmh-p828"},{"rule_id":"osv/GHSA-6j4f-fj2g-mc7p","severity":"high","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-6j4f-fj2g-mc7p","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-6j4f-fj2g-mc7p"},{"rule_id":"osv/GHSA-qhr7-859c-m2p7","severity":"high","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-qhr7-859c-m2p7","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-qhr7-859c-m2p7"},{"rule_id":"osv/GHSA-2gc4-cqfq-p2gv","severity":"high","message":"engine.io@6.6.9 (npm) is affected by GHSA-2gc4-cqfq-p2gv","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"engine.io@6.6.9 (npm):GHSA-2gc4-cqfq-p2gv"},{"rule_id":"osv/GHSA-58mr-gqgx-xq4g","severity":"high","message":"fast-uri@3.1.6 (npm) is affected by GHSA-58mr-gqgx-xq4g","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-58mr-gqgx-xq4g"},{"rule_id":"osv/GHSA-qw65-cvwx-89v3","severity":"high","message":"fast-uri@3.1.6 (npm) is affected by GHSA-qw65-cvwx-89v3","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-qw65-cvwx-89v3"},{"rule_id":"osv/GHSA-8r9p-f939-6h3c","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-8r9p-f939-6h3c","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-8r9p-f939-6h3c"},{"rule_id":"osv/GHSA-mrwp-f3q8-3g9p","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-mrwp-f3q8-3g9p","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-mrwp-f3q8-3g9p"},{"rule_id":"osv/GHSA-q3jh-wrc6-jgq8","severity":"high","message":"follow-redirects@1.16.0 (npm) is affected by GHSA-q3jh-wrc6-jgq8","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"follow-redirects@1.16.0 (npm):GHSA-q3jh-wrc6-jgq8"},{"rule_id":"osv/GHSA-68fv-2mgg-jv7q","severity":"high","message":"source-map-js@1.2.1 (npm) is affected by GHSA-68fv-2mgg-jv7q","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"source-map-js@1.2.1 (npm):GHSA-68fv-2mgg-jv7q"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@2.1.4 (npm) is affected by GHSA-q2hr-2g5m-vwhr; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"brace-expansion@2.1.4 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-3g3m-2fjr-6pw4","severity":"medium","message":"glob@10.5.0 (npm) is affected by GHSA-3g3m-2fjr-6pw4; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"glob@10.5.0 (npm):GHSA-3g3m-2fjr-6pw4"},{"rule_id":"osv/GHSA-g3hv-75wg-m249","severity":"medium","message":"minimatch@9.0.9 (npm) is affected by GHSA-g3hv-75wg-m249; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"minimatch@9.0.9 (npm):GHSA-g3hv-75wg-m249"},{"rule_id":"osv/GHSA-qj8w-gfj5-8c6v","severity":"medium","message":"serialize-javascript@6.0.2 (npm) is affected by GHSA-qj8w-gfj5-8c6v; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"serialize-javascript@6.0.2 (npm):GHSA-qj8w-gfj5-8c6v"},{"rule_id":"osv/GHSA-q2hr-2g5m-vwhr","severity":"medium","message":"brace-expansion@1.1.18 (npm) is affected by GHSA-q2hr-2g5m-vwhr","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"brace-expansion@1.1.18 (npm):GHSA-q2hr-2g5m-vwhr"},{"rule_id":"osv/GHSA-hrr3-gc8f-f4qj","severity":"medium","message":"fast-uri@3.1.6 (npm) is affected by GHSA-hrr3-gc8f-f4qj","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-hrr3-gc8f-f4qj"},{"rule_id":"osv/GHSA-w74x-v6f9-j3xg","severity":"medium","message":"fast-uri@3.1.6 (npm) is affected by GHSA-w74x-v6f9-j3xg","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-w74x-v6f9-j3xg"},{"rule_id":"osv/GHSA-wjr9-j795-jxcr","severity":"medium","message":"fast-uri@3.1.6 (npm) is affected by GHSA-wjr9-j795-jxcr","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-wjr9-j795-jxcr"},{"rule_id":"osv/GHSA-4mjr-xmp4-gh2g","severity":"medium","message":"qs@6.15.3 (npm) is affected by GHSA-4mjr-xmp4-gh2g","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"qs@6.15.3 (npm):GHSA-4mjr-xmp4-gh2g"},{"rule_id":"osv/GHSA-6pq8-jhm2-2vcw","severity":"medium","message":"qs@6.15.3 (npm) is affected by GHSA-6pq8-jhm2-2vcw","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"qs@6.15.3 (npm):GHSA-6pq8-jhm2-2vcw"},{"rule_id":"osv/GHSA-x5fp-wj9c-mxmx","severity":"medium","message":"qs@6.15.3 (npm) is affected by GHSA-x5fp-wj9c-mxmx","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"qs@6.15.3 (npm):GHSA-x5fp-wj9c-mxmx"},{"rule_id":"osv/GHSA-73rr-hh4g-fpgx","severity":"low","message":"diff@7.0.0 (npm) is affected by GHSA-73rr-hh4g-fpgx; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"diff@7.0.0 (npm):GHSA-73rr-hh4g-fpgx"},{"rule_id":"osv/GHSA-m5mm-p8h7-m29v","severity":"low","message":"serialize-javascript@6.0.2 (npm) is affected by GHSA-m5mm-p8h7-m29v; also in html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","path":"html/kotlinx-browser-common-subset/generator/kotlin-js-store/yarn.lock","line":null,"fingerprint":"serialize-javascript@6.0.2 (npm):GHSA-m5mm-p8h7-m29v"},{"rule_id":"osv/GHSA-333x-w4r6-6crp","severity":"low","message":"fast-uri@3.1.6 (npm) is affected by GHSA-333x-w4r6-6crp","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-333x-w4r6-6crp"},{"rule_id":"osv/GHSA-xhq7-xmqj-769h","severity":"low","message":"fast-uri@3.1.6 (npm) is affected by GHSA-xhq7-xmqj-769h","path":"html/kotlinx-browser-common-subset/kotlin-js-store/yarn.lock","line":null,"fingerprint":"fast-uri@3.1.6 (npm):GHSA-xhq7-xmqj-769h"}],"evidence":[],"data":{"ecosystems":["Maven","npm"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":7.0,"findings":63.0,"findings_high":30.0,"findings_medium":27.0,"findings_low":6.0,"penalty":415.2},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/actions/setup-prerequisites/action.yml","line":6,"fingerprint":"unpinned-uses:.github/actions/setup-prerequisites/action.yml:6"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/actions/setup-prerequisites/action.yml","line":14,"fingerprint":"unpinned-uses:.github/actions/setup-prerequisites/action.yml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/actions/setup-prerequisites/action.yml","line":19,"fingerprint":"unpinned-uses:.github/actions/setup-prerequisites/action.yml:19"},{"rule_id":"zizmor/template-injection","severity":"high","message":"code injection via template expansion [confidence high]","path":".github/actions/setup-xcode/action.yml","line":17,"fingerprint":"template-injection:.github/actions/setup-xcode/action.yml:17"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/actions/setup-xcode/action.yml","line":21,"fingerprint":"unpinned-uses:.github/actions/setup-xcode/action.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmarks-smoke.yml","line":18,"fingerprint":"unpinned-uses:.github/workflows/benchmarks-smoke.yml:18"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmarks-smoke.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/benchmarks-smoke.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmarks-smoke.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/benchmarks-smoke.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmarks-smoke.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/benchmarks-smoke.yml:33"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmarks-smoke.yml","line":46,"fingerprint":"unpinned-uses:.github/workflows/benchmarks-smoke.yml:46"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/benchmarks-smoke.yml","line":47,"fingerprint":"unpinned-uses:.github/workflows/benchmarks-smoke.yml:47"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/check-release-notes.yml","line":16,"fingerprint":"unpinned-uses:.github/workflows/check-release-notes.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci-build-helpers.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/ci-build-helpers.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci-build-helpers.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/ci-build-helpers.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compose-html-eap.yml","line":34,"fingerprint":"unpinned-uses:.github/workflows/compose-html-eap.yml:34"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compose-html-eap.yml","line":37,"fingerprint":"unpinned-uses:.github/workflows/compose-html-eap.yml:37"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/compose-html-eap.yml","line":45,"fingerprint":"unpinned-uses:.github/workflows/compose-html-eap.yml:45"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/examples.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/examples.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/examples.yml","line":36,"fingerprint":"unpinned-uses:.github/workflows/examples.yml:36"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/examples.yml","line":49,"fingerprint":"unpinned-uses:.github/workflows/examples.yml:49"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/examples.yml","line":62,"fingerprint":"unpinned-uses:.github/workflows/examples.yml:62"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gradle-plugin.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/gradle-plugin.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gradle-plugin.yml","line":42,"fingerprint":"unpinned-uses:.github/workflows/gradle-plugin.yml:42"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gradle-plugin.yml","line":51,"fingerprint":"unpinned-uses:.github/workflows/gradle-plugin.yml:51"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/gradle-plugin.yml","line":70,"fingerprint":"unpinned-uses:.github/workflows/gradle-plugin.yml:70"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/kotlinx-browser-common-subset.yml","line":22,"fingerprint":"unpinned-uses:.github/workflows/kotlinx-browser-common-subset.yml:22"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/kotlinx-browser-common-subset.yml","line":25,"fingerprint":"unpinned-uses:.github/workflows/kotlinx-browser-common-subset.yml:25"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/kotlinx-browser-common-subset.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/kotlinx-browser-common-subset.yml:33"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":"tools/changelog/check-release-notes-github-action/action.yml","line":16,"fingerprint":"unpinned-uses:tools/changelog/check-release-notes-github-action/action.yml:16"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":"tools/changelog/check-release-notes-github-action/action.yml","line":23,"fingerprint":"unpinned-uses:tools/changelog/check-release-notes-github-action/action.yml:23"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/benchmarks-smoke.yml","line":18,"fingerprint":"artipacked:.github/workflows/benchmarks-smoke.yml:18"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/benchmarks-smoke.yml","line":32,"fingerprint":"artipacked:.github/workflows/benchmarks-smoke.yml:32"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/benchmarks-smoke.yml","line":46,"fingerprint":"artipacked:.github/workflows/benchmarks-smoke.yml:46"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/benchmarks-smoke.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/benchmarks-smoke.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/benchmarks-smoke.yml","line":15,"fingerprint":"excessive-permissions:.github/workflows/benchmarks-smoke.yml:15"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/benchmarks-smoke.yml","line":29,"fingerprint":"excessive-permissions:.github/workflows/benchmarks-smoke.yml:29"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/benchmarks-smoke.yml","line":43,"fingerprint":"excessive-permissions:.github/workflows/benchmarks-smoke.yml:43"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/check-release-notes.yml","line":16,"fingerprint":"artipacked:.github/workflows/check-release-notes.yml:16"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/check-release-notes.yml","line":13,"fingerprint":"excessive-permissions:.github/workflows/check-release-notes.yml:13"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci-build-helpers.yml","line":18,"fingerprint":"artipacked:.github/workflows/ci-build-helpers.yml:18"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci-build-helpers.yml","line":15,"fingerprint":"excessive-permissions:.github/workflows/ci-build-helpers.yml:15"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/compose-html-eap.yml","line":33,"fingerprint":"artipacked:.github/workflows/compose-html-eap.yml:33"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/compose-html-eap.yml","line":30,"fingerprint":"excessive-permissions:.github/workflows/compose-html-eap.yml:30"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/examples.yml","line":22,"fingerprint":"artipacked:.github/workflows/examples.yml:22"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/examples.yml","line":35,"fingerprint":"artipacked:.github/workflows/examples.yml:35"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/examples.yml","line":48,"fingerprint":"artipacked:.github/workflows/examples.yml:48"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/examples.yml","line":61,"fingerprint":"artipacked:.github/workflows/examples.yml:61"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/examples.yml","line":1,"fingerprint":"excessive-permissions:.github/workflows/examples.yml:1"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/examples.yml","line":19,"fingerprint":"excessive-permissions:.github/workflows/examples.yml:19"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/examples.yml","line":32,"fingerprint":"excessive-permissions:.github/workflows/examples.yml:32"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/examples.yml","line":45,"fingerprint":"excessive-permissions:.github/workflows/examples.yml:45"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/examples.yml","line":58,"fingerprint":"excessive-permissions:.github/workflows/examples.yml:58"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/gradle-plugin.yml","line":24,"fingerprint":"artipacked:.github/workflows/gradle-plugin.yml:24"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/gradle-plugin.yml","line":15,"fingerprint":"excessive-permissions:.github/workflows/gradle-plugin.yml:15"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/kotlinx-browser-common-subset.yml","line":21,"fingerprint":"artipacked:.github/workflows/kotlinx-browser-common-subset.yml:21"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/kotlinx-browser-common-subset.yml","line":18,"fingerprint":"excessive-permissions:.github/workflows/kotlinx-browser-common-subset.yml:18"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":"tools/changelog/check-release-notes-github-action/action.yml","line":16,"fingerprint":"artipacked:tools/changelog/check-release-notes-github-action/action.yml:16"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/check-release-notes.yml","line":19,"fingerprint":"self-repository:.github/workflows/check-release-notes.yml:19"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/examples.yml","line":26,"fingerprint":"self-repository:.github/workflows/examples.yml:26"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/examples.yml","line":39,"fingerprint":"self-repository:.github/workflows/examples.yml:39"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/examples.yml","line":52,"fingerprint":"self-repository:.github/workflows/examples.yml:52"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/examples.yml","line":65,"fingerprint":"self-repository:.github/workflows/examples.yml:65"},{"rule_id":"zizmor/self-repository","severity":"low","message":"use GitHub's dedicated self-repository syntax [confidence high]","path":".github/workflows/examples.yml","line":68,"fingerprint":"self-repository:.github/workflows/examples.yml:68"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":1.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":1.0,"signed_commit_share":1.0,"unpinned_manifests":0.0},"findings":[],"evidence":[{"kind":"posture","description":"Security policy: SECURITY.md","ref":"SECURITY.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":7417.0,"function_nloc":73468.0,"mean_ccn":1.48,"p90_ccn":2.0,"complex_functions":19.0,"long_functions":23.0,"many_param_functions":43.0,"risky_nloc_share":0.0603},"findings":[],"evidence":[{"kind":"complex-function","description":"FormApp in html/eap/benchmarks/src/commonMain/kotlin/benchmarks/compose/FormApp.kt: complexity 31, 103 lines","ref":"html/eap/benchmarks/src/commonMain/kotlin/benchmarks/compose/FormApp.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/html/eap/benchmarks/src/commonMain/kotlin/benchmarks/compose/FormApp.kt#L27","weight":0.5166666666666667},{"kind":"complex-function","description":"(anonymous) in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt: complexity 26, 37 lines","ref":"html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt#L143","weight":0.43333333333333335},{"kind":"complex-function","description":"parseArgs in benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Config.kt: complexity 24, 73 lines","ref":"benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Config.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Config.kt#L35","weight":0.4},{"kind":"complex-function","description":"(anonymous) in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt: complexity 24, 71 lines","ref":"html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/WrapperCallNormalizer.kt#L219","weight":0.4},{"kind":"complex-function","description":"formatBinary32 in html/eap/core/src/jvmMain/kotlin/org/jetbrains/compose/web/css/CSSNumberFormatting.jvm.kt: complexity 23, 49 lines","ref":"html/eap/core/src/jvmMain/kotlin/org/jetbrains/compose/web/css/CSSNumberFormatting.jvm.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/html/eap/core/src/jvmMain/kotlin/org/jetbrains/compose/web/css/CSSNumberFormatting.jvm.kt#L19","weight":0.38333333333333336},{"kind":"complex-function","description":"foldExpression in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/ConstantEvaluator.kt: complexity 22, 41 lines","ref":"html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/ConstantEvaluator.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/ConstantEvaluator.kt#L87","weight":0.36666666666666664},{"kind":"complex-function","description":"BenchmarkRunner in benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Benchmarks.kt: complexity 21, 140 lines","ref":"benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Benchmarks.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/Benchmarks.kt#L430","weight":0.35},{"kind":"complex-function","description":"fromString in html/core/src/jsMain/kotlin/org/jetbrains/compose/web/attributes/PredefinedAttrValues.kt: complexity 21, 25 lines","ref":"html/core/src/jsMain/kotlin/org/jetbrains/compose/web/attributes/PredefinedAttrValues.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/html/core/src/jsMain/kotlin/org/jetbrains/compose/web/attributes/PredefinedAttrValues.kt#L55","weight":0.35},{"kind":"complex-function","description":"fromString in html/eap/core/src/commonMain/kotlin/org/jetbrains/compose/web/attributes/PredefinedAttrValues.kt: complexity 21, 25 lines","ref":"html/eap/core/src/commonMain/kotlin/org/jetbrains/compose/web/attributes/PredefinedAttrValues.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/html/eap/core/src/commonMain/kotlin/org/jetbrains/compose/web/attributes/PredefinedAttrValues.kt#L63","weight":0.35},{"kind":"complex-function","description":"encodeChildren in html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/HtmlAnalysis.kt: complexity 20, 56 lines","ref":"html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/HtmlAnalysis.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/html/eap/compiler-plugin/src/main/kotlin/org/jetbrains/compose/html/compiler/lowering/HtmlAnalysis.kt#L173","weight":0.3333333333333333}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":100685.0,"duplicated_lines":32357.0,"duplicated_share":0.3214,"files":1554.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/build.gradle.kts:16 and benchmarks/multiplatform/build.gradle.kts:18","ref":"benchmarks/multiplatform/benchmarks/build.gradle.kts","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/build.gradle.kts#L16","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/androidMain/kotlin/MeasureComposable.android.kt:14 and benchmarks/multiplatform/benchmarks/src/skikoMain/kotlin/MeasureComposable.skiko.kt:53","ref":"benchmarks/multiplatform/benchmarks/src/androidMain/kotlin/MeasureComposable.android.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/androidMain/kotlin/MeasureComposable.android.kt#L14","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/androidMain/kotlin/MeasureComposable.android.kt:15 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/MeasureComposable.kt:14","ref":"benchmarks/multiplatform/benchmarks/src/androidMain/kotlin/MeasureComposable.android.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/androidMain/kotlin/MeasureComposable.android.kt#L15","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/appleMain/kotlin/GraphicsContext.apple.kt:43 and benchmarks/multiplatform/benchmarks/src/desktopMain/kotlin/GraphicsContext.desktop.kt:33","ref":"benchmarks/multiplatform/benchmarks/src/appleMain/kotlin/GraphicsContext.apple.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/appleMain/kotlin/GraphicsContext.apple.kt#L43","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/canvasdrawing/CanvasDrawing.kt:46 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/heavyshader/HeavyShader.kt:45","ref":"benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/canvasdrawing/CanvasDrawing.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/canvasdrawing/CanvasDrawing.kt#L46","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/components/MultiLevelCell.kt:116 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/components/MultiLevelCell.kt:139","ref":"benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/components/MultiLevelCell.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/components/MultiLevelCell.kt#L116","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/models/FollowItem.kt:4 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/models/HotItem.kt:4","ref":"benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/models/FollowItem.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/complexlazylist/models/FollowItem.kt#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt:4 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/MultipleComponents.kt:4","ref":"benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt#L4","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt:231 and benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt:253","ref":"benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/Clickable.kt#L231","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/MultipleComponents.kt:2 and components/ui-tooling-preview/library/src/androidMain/kotlin/org/jetbrains/compose/ui/tooling/preview/PreviewParameter.android.kt:2","ref":"benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/MultipleComponents.kt","url":"https://github.com/JetBrains/compose-multiplatform/blob/8431de3fdab6251ce5a0d7ab07303f5c85b13827/benchmarks/multiplatform/benchmarks/src/commonMain/kotlin/benchmarks/multipleComponents/MultipleComponents.kt#L2","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":29.0,"weighted_findings":9.5,"scanned_lines":169381.0,"category:best-practice":3.0,"category:correctness":26.0},"findings":[{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js","line":8,"fingerprint":"javascript.lang.best-practice.lazy-load-module:html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js:8"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js","line":9,"fingerprint":"javascript.lang.best-practice.lazy-load-module:html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js:9"},{"rule_id":"opengrep/javascript.lang.best-practice.lazy-load-module","severity":"medium","message":"Lazy loading can complicate code bundling if care is not taken, also `require`s are run synchronously by Node.js. If they are called from within a function, it may block other requests from being handled at a more critical time. The best practice is to `require` modules at the beginning of each file","path":"html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js","line":12,"fingerprint":"javascript.lang.best-practice.lazy-load-module:html/test-utils/conf/karma-kotlin-runner-decorator/karma-kotlin-reporter-decorated.js:12"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"benchmarks/showcases/LazyGridImageView/download_images.sh","line":15,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:benchmarks/showcases/LazyGridImageView/download_images.sh:15"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"benchmarks/showcases/LazyGridImageView/download_images.sh","line":40,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:benchmarks/showcases/LazyGridImageView/download_images.sh:40"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"benchmarks/showcases/LazyGridImageView/download_images.sh","line":43,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:benchmarks/showcases/LazyGridImageView/download_images.sh:43"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"compose/scripts/validateProjects.sh","line":16,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:compose/scripts/validateProjects.sh:16"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"compose/scripts/validateProjects.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:compose/scripts/validateProjects.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replaceVersionInExamples.sh","line":41,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replaceVersionInExamples.sh:41"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replaceVersionInExamples.sh","line":42,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replaceVersionInExamples.sh:42"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replaceVersionInExamples.sh","line":43,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replaceVersionInExamples.sh:43"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replaceVersionInLibs.sh","line":40,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replaceVersionInLibs.sh:40"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replaceVersionInLibs.sh","line":41,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replaceVersionInLibs.sh:41"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replaceVersionInLibs.sh","line":42,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replaceVersionInLibs.sh:42"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":11,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:11"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":16,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:16"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":17,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:17"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":18,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:18"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":19,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:19"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":20,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:20"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":21,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:21"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":22,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:22"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":23,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:23"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":24,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:24"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":25,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:25"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":26,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:26"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":27,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:27"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/replace_version_common.sh","line":28,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/replace_version_common.sh:28"},{"rule_id":"opengrep/bash.lang.correctness.unquoted-variable-expansion-in-command","severity":"low","message":"Variable expansions must be double-quoted so as to prevent being split into multiple pieces according to whitespace or whichever separator is specified by the IFS variable. If you really wish to split the variable's contents, you may use a variable that starts with an underscore e.g. $_X instead of ","path":"tools/upload_package_from_prebuilts.sh","line":43,"fingerprint":"bash.lang.correctness.unquoted-variable-expansion-in-command:tools/upload_package_from_prebuilts.sh:43"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.4586,"check:ci_present":1.0,"check:ci_runs_tests":0.0,"check:ci_runs_lint":0.0,"check:tests_cochange":0.9741,"test_lines":38840.0,"source_lines":169381.0,"test_ratio":0.2293,"ci_files":7.0,"cochange_share":0.2435,"cochange_commits":193.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/benchmarks-smoke.yml","ref":".github/workflows/benchmarks-smoke.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/check-release-notes.yml","ref":".github/workflows/check-release-notes.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/ci-build-helpers.yml","ref":".github/workflows/ci-build-helpers.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/compose-html-eap.yml","ref":".github/workflows/compose-html-eap.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/examples.yml","ref":".github/workflows/examples.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/gradle-plugin.yml","ref":".github/workflows/gradle-plugin.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/kotlinx-browser-common-subset.yml","ref":".github/workflows/kotlinx-browser-common-subset.yml","url":null,"weight":0.0}],"data":{"test_commands":[],"lint_commands":[]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":58.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE.txt","ref":"LICENSE.txt","url":null,"weight":0.0},{"kind":"docs","description":"CONTRIBUTING.md","ref":"CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":512.0,"other_lines":164629.0,"files_blamed":1500.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":25.0,"quality:other_per_kloc":0.152,"quality:ratio":0.0,"security:ai_findings":0.0,"security:ai_per_kloc":0.0,"security:other_findings":19.0,"security:other_per_kloc":0.115,"security:ratio":0.0},"findings":[],"evidence":[],"data":{"sampled":true,"comparable":true},"error":null}],"flags":[]}