Enforce truthful required CI checks

[KooshaPari]

What changed

• makes the required CI result propagate workspace, cargo-deny, CI-contract, change-detection, and conditional-job failures
• removes swallowed npm staging failures, requires frozen installs, resolves authoritative release workflows, and verifies a pinned public release fallback
• adds executable CI contracts, records the npm staging trust boundary, and makes the README ASCII gate use equivalent ASCII typography
• restricts the npm CI GITHUB_TOKEN to contents: read
• restricts the mutable Rust CI GITHUB_TOKEN to contents: read
• keeps resolved deterministic gates green while retaining infrastructure, credential, artifact-retention, and baseline failures as proper red

Why

Several required jobs could appear green without proving all underlying checks succeeded. This change makes the aggregate result truthful and distinguishes successful failure propagation from actual release readiness.

Validation

• required-CI contract: 12/12 passed
• complete .github/scripts discovery: 44/44 passed
• scripts discovery: 19/19 passed
• Python syntax, validator execution, and diff checks passed
• hosted argument-comment-lint package: green, including its strict clean-worktree check
• live npm staging: verified all seven pinned release assets and uploaded the root package artifact

Truthful status

• staging failures propagate to the job and required result
• release workflow lookup targets openai/codex
• npm CI token is restricted to contents: read
• Rust CI token is restricted to contents: read
• successful npm staging: expired workflow artifacts fall back only to the exact seven rust-v0.115.0 public assets with size, SHA-256, URL, and embedded package validation`n- [x] README ASCII gate passes with equivalent ASCII prose and tree notation
• full CI green: OXC formatting, external services, zero-step runner infrastructure, cargo-deny, Bazel/module-lock, and other broad baselines remain proper red

The security evidence and acceptance boundary are recorded in docs/security/threat-model.md. This PR remains draft; no release credential, artifact validation, workflow permission, or release-version gate was weakened.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​v8@​149.2.0
	cargo/​tree-sitter@​0.25.10
	cargo/​tokio@​1.52.3
	cargo/​gix@​0.81.0
	cargo/​dylint_linting@​5.0.0
	cargo/​libsqlite3-sys@​0.37.0
	cargo/​allocative@​0.3.6
	cargo/​assert_cmd@​2.1.2
	cargo/​reqwest@​0.12.28
	cargo/​libc@​0.2.186
	cargo/​thiserror@​2.0.18
	cargo/​reqwest@​0.13.4
	cargo/​proc-macro2@​1.0.106
	cargo/​anyhow@​1.0.102
	cargo/​thiserror@​1.0.69
	cargo/​aws-types@​1.3.11
	cargo/​serde@​1.0.228
	cargo/​starlark@​0.14.2
	cargo/​rustls@​0.23.36
	cargo/​zip@​2.4.2
	cargo/​quote@​1.0.45
	cargo/​pulldown-cmark@​0.10.3
	cargo/​serde_json@​1.0.149
	cargo/​indexmap@​1.9.3
	cargo/​owo-colors@​4.3.0
	cargo/​async-io@​2.6.0
	cargo/​winapi@​0.3.9
	cargo/​serde_with@​3.17.0
	cargo/​rmcp@​1.8.0
	cargo/​assert_matches@​1.5.0
	cargo/​constant_time_eq@​0.1.5
	cargo/​constant_time_eq@​0.3.1
	cargo/​derive_more@​1.0.0
See 197 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo aws-lc-sys is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/rama-tls-rustls@0.3.0-alpha.4 → cargo/rustls@0.23.36 → cargo/rcgen@0.14.7 → cargo/reqwest@0.13.4 → cargo/aws-lc-sys@0.39.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/aws-lc-sys@0.39.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo aws-lc-sys is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/rama-tls-rustls@0.3.0-alpha.4 → cargo/rustls@0.23.36 → cargo/rcgen@0.14.7 → cargo/reqwest@0.13.4 → cargo/aws-lc-sys@0.39.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/aws-lc-sys@0.39.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: cargo gix-fs: Symlink prefix-reuse allows worktree escape during checkout CVE: GHSA-f89h-2fjh-2r9q gix-fs: Symlink prefix-reuse allows worktree escape during checkout (HIGH) Affected versions: < 0.21.1 Patched version: 0.21.1 From: ? → cargo/gix@0.81.0 → cargo/gix-fs@0.19.2 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/gix-fs@0.19.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: cargo gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data CVE: GHSA-x494-mj8g-cj27 gix-pack has multiple DoS vectors: unchecked indexing panics and uncapped OOM allocations from crafted pack data (HIGH) Affected versions: < 0.69.0 Patched version: 0.69.0 From: ? → cargo/gix@0.81.0 → cargo/gix-pack@0.68.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/gix-pack@0.68.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure in cargo gix-validate CVE: GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure (HIGH) Affected versions: < 0.11.1 Patched version: 0.11.1 From: ? → cargo/gix@0.81.0 → cargo/gix-validate@0.11.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/gix-validate@0.11.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: gitoxide: CommandForbiddenInModulesConfiguration Bypass in cargo gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules CVE: GHSA-f26g-jm89-4g65 gitoxide: CommandForbiddenInModulesConfiguration Bypass in gix_submodule::File::update() Enables Arbitrary Command Execution via .gitmodules (HIGH) Affected versions: >= 0.31.0 < 0.83.0 Patched version: 0.83.0 From: codex-rs/Cargo.lock → cargo/gix@0.81.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/gix@0.81.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: cargo gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure CVE: GHSA-p3hw-mv63-rf9w gix's submodule name validation bypass + trust inheritance flaw enables path traversal and credential disclosure (HIGH) Affected versions: < 0.83.0 Patched version: 0.83.0 From: codex-rs/Cargo.lock → cargo/gix@0.81.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/gix@0.81.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: cargo gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository CVE: GHSA-fr8x-3vfx-f45h gix and gitoxide: unvalidated submodule name traverses out of .git/modules and redirects state() / open() to another repository (HIGH) Affected versions: < 0.83.0 Patched version: 0.83.0 From: codex-rs/Cargo.lock → cargo/gix@0.81.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/gix@0.81.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: cargo gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository CVE: GHSA-pg4w-g64p-qwhj gix and gitoxide's symlinked .gitmodules are followed and parsed from outside of the repository (HIGH) Affected versions: < 0.83.0 Patched version: 0.83.0 From: codex-rs/Cargo.lock → cargo/gix@0.81.0 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/gix@0.81.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: cargo hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses CVE: GHSA-3v94-mw7p-v465 hickory-proto: NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses (HIGH) Affected versions: >= 0.25.0-alpha.3 <= 0.25.2 Patched version: No patched versions From: ? → cargo/rama-tcp@0.3.0-alpha.4 → cargo/hickory-proto@0.25.2 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/hickory-proto@0.25.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo hyper-util is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/aws-config@1.8.12 → cargo/axum@0.8.8 → cargo/reqwest@0.12.28 → cargo/tonic@0.14.3 → cargo/reqwest@0.13.4 → cargo/wiremock@0.6.5 → cargo/hyper-util@0.1.20 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/hyper-util@0.1.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/age@0.11.2 → cargo/aws-config@1.8.12 → cargo/reqwest@0.12.28 → cargo/rama-http@0.3.0-alpha.4 → cargo/rama-tcp@0.3.0-alpha.4 → cargo/rama-http-backend@0.3.0-alpha.4 → cargo/rama-net@0.3.0-alpha.4 → cargo/rama-tls-rustls@0.3.0-alpha.4 → cargo/rama-core@0.3.0-alpha.4 → cargo/rustls@0.23.36 → cargo/rcgen@0.14.7 → cargo/uuid@1.20.0 → cargo/clatter@2.2.0 → cargo/cc@1.2.55 → cargo/clap@4.5.58 → cargo/tempfile@3.27.0 → cargo/tar@0.4.45 → cargo/gix@0.81.0 → cargo/dylint_linting@5.0.0 → cargo/dylint_testing@5.0.0 → cargo/rand@0.9.3 → cargo/rand@0.10.1 → cargo/rand@0.8.6 → cargo/tokio@1.52.3 → cargo/sqlx@0.9.0 → cargo/reqwest@0.13.4 → cargo/starlark@0.14.2 → cargo/zip@0.6.6 → cargo/zip@2.4.2 → cargo/sha2@0.10.9 → cargo/sha1@0.10.6 → cargo/hmac@0.12.1 → cargo/dirs-next@2.0.0 → cargo/ed25519-dalek@2.2.0 → cargo/which@6.0.3 → cargo/dirs@6.0.0 → cargo/oauth2@5.0.0 → cargo/jsonwebtoken@9.3.1 → cargo/which@8.0.0 → cargo/wiremock@0.6.5 → cargo/keyring@3.6.3 → cargo/arboard@3.6.1 → cargo/async-io@2.6.0 → cargo/bm25@2.3.2 → cargo/crypto_box@0.9.1 → cargo/opentelemetry-otlp@0.31.0 → cargo/gethostname@1.1.0 → cargo/libc@0.2.183 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.183. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/age@0.11.2 → cargo/aws-config@1.8.12 → cargo/reqwest@0.12.28 → cargo/rama-http@0.3.0-alpha.4 → cargo/rama-tcp@0.3.0-alpha.4 → cargo/rama-http-backend@0.3.0-alpha.4 → cargo/rama-net@0.3.0-alpha.4 → cargo/rama-tls-rustls@0.3.0-alpha.4 → cargo/rama-core@0.3.0-alpha.4 → cargo/rustls@0.23.36 → cargo/rcgen@0.14.7 → cargo/uuid@1.20.0 → cargo/clatter@2.2.0 → cargo/cc@1.2.55 → cargo/clap@4.5.58 → cargo/tempfile@3.27.0 → cargo/tar@0.4.45 → cargo/gix@0.81.0 → cargo/dylint_linting@5.0.0 → cargo/dylint_testing@5.0.0 → cargo/rand@0.9.3 → cargo/rand@0.10.1 → cargo/rand@0.8.6 → cargo/tokio@1.52.3 → cargo/sqlx@0.9.0 → cargo/reqwest@0.13.4 → cargo/starlark@0.14.2 → cargo/zip@0.6.6 → cargo/zip@2.4.2 → cargo/sha2@0.10.9 → cargo/sha1@0.10.6 → cargo/hmac@0.12.1 → cargo/dirs-next@2.0.0 → cargo/ed25519-dalek@2.2.0 → cargo/which@6.0.3 → cargo/dirs@6.0.0 → cargo/oauth2@5.0.0 → cargo/jsonwebtoken@9.3.1 → cargo/which@8.0.0 → cargo/wiremock@0.6.5 → cargo/keyring@3.6.3 → cargo/arboard@3.6.1 → cargo/async-io@2.6.0 → cargo/bm25@2.3.2 → cargo/crypto_box@0.9.1 → cargo/opentelemetry-otlp@0.31.0 → cargo/gethostname@1.1.0 → cargo/libc@0.2.183 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.183. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo libc is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: codex-rs/app-server-daemon/Cargo.toml → cargo/libc@0.2.186 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libc@0.2.186. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: cargo libgit2-sys under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (libgit2-sys-0.18.3+1.9.2/libgit2/COPYING) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (libgit2-sys-0.18.3+1.9.2/libgit2/COPYING) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (libgit2-sys-0.18.3+1.9.2/libgit2/deps/pcre/COPYING) From: ? → cargo/dylint_linting@5.0.0 → cargo/dylint_testing@5.0.0 → cargo/libgit2-sys@0.18.3%2B1.9.2 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/libgit2-sys@0.18.3%2B1.9.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: cargo lzma-sys under unrecognized license License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (lzma-sys-0.1.20/xz-5.2/COPYING) License: unrecognized license - This license was not allowed or given any lesser classification by the applicable policy (lzma-sys-0.1.20/xz-5.2/COPYING) From: ? → cargo/zip@2.4.2 → cargo/lzma-sys@0.1.20 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/lzma-sys@0.1.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo openssl is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/sentry@0.46.1 → cargo/openssl@0.10.75 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.75. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: rust-cargo openssl has incorrect bounds assertion in aes key wrap CVE: GHSA-8c75-8mhr-p7r9 rust-openssl has incorrect bounds assertion in aes key wrap (HIGH) Affected versions: >= 0.10.24 < 0.10.78 Patched version: 0.10.78 From: ? → cargo/reqwest@0.12.28 → cargo/sentry@0.46.1 → cargo/openssl@0.10.75 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.75. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: rust-cargo openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check CVE: GHSA-ghm9-cr32-g9qj rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check (HIGH) Affected versions: >= 0.10.39 < 0.10.78 Patched version: 0.10.78 From: ? → cargo/reqwest@0.12.28 → cargo/sentry@0.46.1 → cargo/openssl@0.10.75 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.75. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: rust-cargo openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs CVE: GHSA-xp3w-r5p5-63rr rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (HIGH) Affected versions: >= 0.9.7 < 0.10.79 Patched version: 0.10.79 From: ? → cargo/reqwest@0.12.28 → cargo/sentry@0.46.1 → cargo/openssl@0.10.75 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.75. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: rust-cargo openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer CVE: GHSA-hppc-g8h3-xhp3 rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer (HIGH) Affected versions: >= 0.9.24 < 0.10.78 Patched version: 0.10.78 From: ? → cargo/reqwest@0.12.28 → cargo/sentry@0.46.1 → cargo/openssl@0.10.75 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.75. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: rust-cargo openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 CVE: GHSA-pqf5-4pqq-29f5 rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1 (HIGH) Affected versions: >= 0.9.27 < 0.10.78 Patched version: 0.10.78 From: ? → cargo/reqwest@0.12.28 → cargo/sentry@0.46.1 → cargo/openssl@0.10.75 ℹ Read more on: This package | This alert | What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.75. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: cargo rustc_apfloat License: Apache-2.0 WITH LLVM-exception - The applicable license policy does not permit this license (5) (rustc_apfloat-0.2.3+llvm-462a31f5a5ab/Cargo.toml) License: Apache-2.0 WITH LLVM-exception - The applicable license policy does not permit this license (5) (rustc_apfloat-0.2.3+llvm-462a31f5a5ab/LICENSE.txt) From: ? → cargo/rustc_apfloat@0.2.3%2Bllvm-462a31f5a5ab ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/rustc_apfloat@0.2.3%2Bllvm-462a31f5a5ab. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo sqlx-core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/sqlx@0.9.0 → cargo/sqlx-core@0.9.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/sqlx-core@0.9.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		License policy violation: cargo target-lexicon License: Apache-2.0 WITH LLVM-exception - The applicable license policy does not permit this license (5) (target-lexicon-0.13.3/Cargo.toml) License: Apache-2.0 WITH LLVM-exception - The applicable license policy does not permit this license (5) (target-lexicon-0.13.3/LICENSE) From: ? → cargo/target-lexicon@0.13.3 ℹ Read more on: This package | This alert | What is a license policy violation? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Find a package that does not violate your license policy or adjust your policy to allow this package's license. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/target-lexicon@0.13.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
See 7 more rows in the dashboard

View full report

[sonarqubecloud]

Quality Gate failed

Failed conditions
E Reliability Rating on New Code (required ≥ A)
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

💡 Need a hand with PR review? Try Gitar by Sonar!

[KooshaPari]

Closing: branch content already merged into main via #626/#625/#621/#615/#609 cascade. No unique work remains.