deps: bump tsx from 4.23.1 to 4.23.12 #355
dependabot[bot]ci.yml
on: pull_request
Matrix: build-test
lint + format (node 20)
32s
coverage (node 22, advisory)
55s
action dist is fresh
21s
supply-chain invariants (zero-dep + pins + REUSE)
16s
dependency review (PR gate)
5s
qScan self-scan (dogfood)
19s
scan benchmark (node 20, advisory)
23s
SARIF structural validation (node 20)
16s
action smoke-test (uses:)
4s
reproducible build (deterministic pack)
24s
Annotations
7 errors and 10 warnings
|
supply-chain invariants (zero-dep + pins + REUSE)
Process completed with exit code 1.
|
|
quantakrypto: RSA key generation:
crypto.ts#L2
Generates a classical RSA key pair, which is not quantum-safe. → ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures
|
|
quantakrypto: RSA key generation:
crypto.ts#L1
Generates a classical RSA key pair, which is not quantum-safe. → ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures
|
|
quantakrypto: RSA key generation:
crypto.ts#L2
Generates a classical RSA key pair, which is not quantum-safe. → ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures
|
|
quantakrypto: RSA key generation:
crypto.ts#L2
Generates a classical RSA key pair, which is not quantum-safe. → ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures
|
|
quantakrypto: RSA key generation:
crypto.ts#L2
Generates a classical RSA key pair, which is not quantum-safe. → ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures
|
|
quantakrypto: RSA key generation:
sample.js#L2
Generates a classical RSA key pair, which is not quantum-safe. → ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures
|
|
quantakrypto: ML-KEM/Kyber size does not match the advertised parameter set:
plain.sarif.json#L11732
Byte size 800 matches ML-KEM-512 but the code advertises ML-KEM-768; parameter-set mismatch (mislabelled level or a copied constant). → review for post-quantum migration
|
|
quantakrypto: ML-KEM/Kyber size does not match the advertised parameter set:
plain.sarif.json#L9734
Byte size 800 matches ML-KEM-512 but the code advertises ML-KEM-768; parameter-set mismatch (mislabelled level or a copied constant). → review for post-quantum migration
|
|
quantakrypto: NuGet package signing (RSA):
plain.sarif.json#L9652
NuGet package signing (nuget sign/dotnet nuget sign) signs an artifact with a classical RSA/ECDSA key; the signature is forgeable once a CRQC can recover the signing key — inventory the signing identity and plan PQC migration. → No PQC code-signing format is broadly standardized yet; track platform roadmaps (e.g. Sigstore/PQC, Authenticode); keep signing-key rotation ready.
|
|
quantakrypto: NuGet package signing (RSA):
plain.sarif.json#L9652
NuGet package signing (nuget sign/dotnet nuget sign) signs an artifact with a classical RSA/ECDSA key; the signature is forgeable once a CRQC can recover the signing key — inventory the signing identity and plan PQC migration. → No PQC code-signing format is broadly standardized yet; track platform roadmaps (e.g. Sigstore/PQC, Authenticode); keep signing-key rotation ready.
|
|
quantakrypto: RPM/deb package signing (RSA):
plain.sarif.json#L9611
RPM/deb package signing (rpmsign/rpm --addsign/dpkg-sig, GPG) signs an artifact with a classical RSA/ECDSA key; the signature is forgeable once a CRQC can recover the signing key — inventory the signing identity and plan PQC migration. → No PQC code-signing format is broadly standardized yet; track platform roadmaps (e.g. Sigstore/PQC, Authenticode); keep signing-key rotation ready.
|
|
quantakrypto: Windows Authenticode code signing (RSA):
plain.sarif.json#L9529
Windows Authenticode (signtool/osslsigncode/Set-AuthenticodeSignature) signs an artifact with a classical RSA/ECDSA key; the signature is forgeable once a CRQC can recover the signing key — inventory the signing identity and plan PQC migration. → No PQC code-signing format is broadly standardized yet; track platform roadmaps (e.g. Sigstore/PQC, Authenticode); keep signing-key rotation ready.
|
|
quantakrypto: SSH certificate authority configured:
plain.sarif.json#L9078
SSH certificate authority is configured (TrustedUserCAKeys / HostCertificate / ssh-keygen -s); the CA signing key is a long-lived classical trust root whose signatures become forgeable once a CRQC exists — verify the CA key's algorithm. → No post-quantum SSH certificate format is standardized yet — track OpenSSH release notes and IETF work on PQC signatures for SSH. SSH CA keys are long-lived trust roots, so plan for their rotation to a PQC signing algorithm (e.g. ML-DSA) as soon as a cert format lands, and keep validity periods short in the interim.
|
|
quantakrypto: SSH certificate authority configured:
plain.sarif.json#L9078
SSH certificate authority is configured (TrustedUserCAKeys / HostCertificate / ssh-keygen -s); the CA signing key is a long-lived classical trust root whose signatures become forgeable once a CRQC exists — verify the CA key's algorithm. → No post-quantum SSH certificate format is standardized yet — track OpenSSH release notes and IETF work on PQC signatures for SSH. SSH CA keys are long-lived trust roots, so plan for their rotation to a PQC signing algorithm (e.g. ML-DSA) as soon as a cert format lands, and keep validity periods short in the interim.
|
|
quantakrypto: SSH certificate authority configured:
plain.sarif.json#L9078
SSH certificate authority is configured (TrustedUserCAKeys / HostCertificate / ssh-keygen -s); the CA signing key is a long-lived classical trust root whose signatures become forgeable once a CRQC exists — verify the CA key's algorithm. → No post-quantum SSH certificate format is standardized yet — track OpenSSH release notes and IETF work on PQC signatures for SSH. SSH CA keys are long-lived trust roots, so plan for their rotation to a PQC signing algorithm (e.g. ML-DSA) as soon as a cert format lands, and keep validity periods short in the interim.
|
|
quantakrypto: SSH certificate authority — EdDSA signing:
plain.sarif.json#L9037
SSH certificate uses a classical Ed25519 key type (ssh-ed25519-cert-v01@openssh.com); modern but still classical — the CA signature is forgeable once a CRQC can recover the Ed25519 CA key. → No post-quantum SSH certificate format is standardized yet — track OpenSSH release notes and IETF work on PQC signatures for SSH. SSH CA keys are long-lived trust roots, so plan for their rotation to a PQC signing algorithm (e.g. ML-DSA) as soon as a cert format lands, and keep validity periods short in the interim.
|