Software Passport · public repository

GCRC/nunaliit

Observed by SPR on 2026-09-14 at commit 88c487830f030b7814e911fd3bedd451615a0b9d (main). Source: github.com/GCRC/nunaliit.

SBOM components109
Open findings40
Critical / high0 / 1
Evidence items113

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 40)

SeverityFindingComponentFixed in
HIGHHard-coded credential assignment
MEDIUMLicense not observedxmpcore
MEDIUMLicense not observedtika-core
MEDIUMLicense not observedslf4j-log4j12
MEDIUMLicense not observedslf4j-api
MEDIUMLicense not observedrhino
MEDIUMLicense not observedpostgresql
MEDIUMLicense not observedpdfbox
MEDIUMLicense not observedmockito-core
MEDIUMLicense not observedmetadata-extractor
MEDIUMLicense not observedmail
MEDIUMLicense not observedjunit
MEDIUMLicense not observedjul-to-slf4j
MEDIUMLicense not observedjsrun
MEDIUMLicense not observedjsoup
MEDIUMLicense not observedjson
MEDIUMLicense not observedjsdoctoolkit-ant-task
MEDIUMLicense not observedjsdebug
MEDIUMLicense not observedjs
MEDIUMLicense not observedjetty-servlets
MEDIUMLicense not observedjetty-servlet
MEDIUMLicense not observedjetty-server
MEDIUMLicense not observedjetty-proxy
MEDIUMLicense not observedjaxb-runtime
MEDIUMLicense not observedjavax.servlet-api

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy