Software Passport · public repository

locationtech/geomesa

Observed by SPR on 2026-09-20 at commit b34b3671c1a85b432b9b750ce8c13010010259d0 (main). Source: github.com/locationtech/geomesa.

SBOM components305
Open findings174
Critical / high0 / 1
Evidence items309

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 174)

SeverityFindingComponentFixed in
HIGHHard-coded credential assignment
MEDIUMLicense not observedzstd-jni
MEDIUMLicense not observedzookeeper-jute
MEDIUMLicense not observedzookeeper
MEDIUMLicense not observedtrino-spi
MEDIUMLicense not observedtrino-plugin-toolkit
MEDIUMLicense not observedtrino-jdbc
MEDIUMLicense not observedtrino-iceberg
MEDIUMLicense not observedtrino-geospatial-toolkit
MEDIUMLicense not observedtestcontainers-trino
MEDIUMLicense not observedtestcontainers-spark
MEDIUMLicense not observedtestcontainers-postgresql
MEDIUMLicense not observedtestcontainers-kafka
MEDIUMLicense not observedtestcontainers-hbase
MEDIUMLicense not observedtestcontainers-cassandra
MEDIUMLicense not observedtestcontainers-accumulo
MEDIUMLicense not observedtestcontainers
MEDIUMLicense not observedsts
MEDIUMLicense not observedstream
MEDIUMLicense not observedspring-security-core
MEDIUMLicense not observedsphinxcontrib-serializinghtml
MEDIUMLicense not observedsphinxcontrib-qthelp
MEDIUMLicense not observedsphinxcontrib-htmlhelp
MEDIUMLicense not observedsphinxcontrib-devhelp
MEDIUMLicense not observedsphinxcontrib-applehelp

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy