gitsafehub
github.com/jwendell/bazel-central-registry ↗

jwendell/bazel-central-registry

scanned 2026-08-09 · git d32f4e1
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets4Vulnerable dependencies16Known OSS vulnerabilities129Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 4 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    modules/opentelemetry-cpp/1.14.2.bcr.1/presubmit.yml:11
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    modules/opentelemetry-cpp/1.14.2/presubmit.yml:11
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    modules/rules_buf/0.5.0/patches/fix_bazel_presubmit.patch:344
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    modules/rules_buf/0.5.0/patches/fix_bazel_presubmit.patch:974
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 16 found · 1 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2026-33186 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-25681). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-27136). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-33814). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-39821). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-47911 golang.org/x/net/html: Quadratic parsing complexity in golang.org/x/net/html
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2025-47911). Fix: Update that package to its patched version.
  • Worth fixing CVE-2025-58190 golang.org/x/net/html: Infinite parsing loop in golang.org/x/net
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2025-58190). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-25680 golang.org/x/net/html: golang.org/x/net/html: Denial of Service due to excessive HTML parsing
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-25680). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42502 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-42502). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-42506 golang.org/x/net/html: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-42506). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2020-14040). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-38561 golang: out-of-bounds read in golang.org/x/text/language leads to DoS
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2021-38561). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-32149 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2022-32149). Fix: Update that package to its patched version.
  • Worth fixing CVE-2026-56852 golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-56852). Fix: Update that package to its patched version.
  • Worth fixing GHSA-hrxh-6v49-42gf gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (GHSA-hrxh-6v49-42gf). Fix: Update that package to its patched version.
  • FYI CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic when the size of a param ...
    tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-46600). Fix: Update that package to its patched version.

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 129 found · 5 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GO-2026-4762 Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-33186). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-2118 Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empt
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/requirements_lock.txt
    A package you depend on has a known security hole (CVE-2026-28802). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-287 Authlib JWS JWK Header Injection: Signature Verification Bypass
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/requirements_lock.txt
    A package you depend on has a known security hole (CVE-2026-27962). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-36 cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Pytho
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/requirements_lock.txt
    A package you depend on has a known security hole (CVE-2026-39892). Fix: Update that package to its patched version.
  • Serious PYSEC-2026-338 FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/requirements_lock.txt
    A package you depend on has a known security hole (CVE-2026-32871). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-5028 Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2026-25680). Fix: Update that package to its patched version.
  • Worth fixing GO-2020-0015 Infinite loop when decoding some inputs in golang.org/x/text
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2020-14040). Fix: Update that package to its patched version.
  • Worth fixing GO-2021-0113 Out-of-bounds read in golang.org/x/text/language
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2021-38561). Fix: Update that package to its patched version.
  • Worth fixing GO-2022-1059 Denial of service via crafted Accept-Language header in golang.org/x/text/language
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole (CVE-2022-32149). Fix: Update that package to its patched version.
  • Worth fixing GO-2026-6061 Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/bzlmod_migration_test_examples/go_extension/go.mod
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-2g4f-4pwh-qvx6 ajv has ReDoS when using `$data` option
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-69873). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3jxr-9vmj-r5cp brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-13149). Fix: Update that package to its patched version.
  • Worth fixing GHSA-f886-m6hf-6m8v brace-expansion: Zero-step sequence causes process hang and memory exhaustion
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-33750). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh99-v99m-4gvg brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-14257). Fix: Update that package to its patched version.
  • Worth fixing GHSA-rgw5-rvv9-x895 brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-69152). Fix: Update that package to its patched version.
  • Worth fixing GHSA-8gh8-hqwg-xf34 Starcounter-Jack JSON-Patch Prototype Pollution vulnerability
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2021-4279). Fix: Update that package to its patched version.
  • Worth fixing GHSA-52cp-r559-cp3m js-yaml: YAML merge-key chains can force quadratic CPU consumption
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-59869). Fix: Update that package to its patched version.
  • Worth fixing GHSA-5p4m-2wfm-xmqj JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Worth fixing GHSA-h67p-54hq-rp68 JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-53550). Fix: Update that package to its patched version.
  • Worth fixing GHSA-mh29-5h37-fv8m js-yaml has prototype pollution in merge (<<)
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2025-64718). Fix: Update that package to its patched version.
  • Worth fixing GHSA-23c5-xmqv-rm74 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-27904). Fix: Update that package to its patched version.
  • Worth fixing GHSA-3ppc-4f35-3m26 minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-26996). Fix: Update that package to its patched version.
  • Worth fixing GHSA-7r86-cg39-jmmj minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/pnpm-lock.yaml
    A package you depend on has a known security hole (CVE-2026-27903). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-1201 Authlib has 1-click Account Takeover vulnerability
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/requirements_lock.txt
    A package you depend on has a known security hole (CVE-2025-68158). Fix: Update that package to its patched version.
  • Worth fixing PYSEC-2026-188 Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's OpenIDImplicitGrant and OpenIDHybridGrant authorizat
    /workdirs/scan-fa5046a3-a7a3-415c-a245-6703cac84089/tools/requirements_lock.txt
    A package you depend on has a known security hole (CVE-2026-44681). Fix: Update that package to its patched version.
… 104 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.