Software Passport · public repository

square/Valet

Observed by SPR on 2026-09-23 at commit 43f517941ced37752c0cd5e2b53a3c9d021c848b (main). Source: github.com/square/Valet.

SBOM components48
Open findings46
Critical / high0 / 1
Evidence items52

What was observed

Syft generated the software bill of materials from the repository's manifests; each component was checked against the OSV vulnerability database; the tree was scanned for secrets, infrastructure-as-code issues and licence signals. Vendor-supplied attestations: none — this page contains only independent observation.

Open findings (top 25 of 46)

SeverityFindingComponentFixed in
HIGHGHSA-3c6g-pvg8-gqw2json@2.7.5
MEDIUMLicense not observedxcodeproj
MEDIUMLicense not observedtzinfo
MEDIUMLicense not observedtyphoeus
MEDIUMLicense not observedsecurerandom
MEDIUMLicense not observedruby-macho
MEDIUMLicense not observedrexml
MEDIUMLicense not observedpublic_suffix
MEDIUMLicense not observednkf
MEDIUMLicense not observednetrc
MEDIUMLicense not observednap
MEDIUMLicense not observednanaimo
MEDIUMLicense not observedmolinillo
MEDIUMLicense not observedminitest
MEDIUMLicense not observedlogger
MEDIUMLicense not observedjson
MEDIUMLicense not observedi18n
MEDIUMLicense not observedhttpclient
MEDIUMLicense not observedgh_inspector
MEDIUMLicense not observedfuzzy_match
MEDIUMLicense not observedfourflusher
MEDIUMLicense not observedffi
MEDIUMLicense not observedethon
MEDIUMLicense not observedescape
MEDIUMLicense not observeddrb

Get the full passport

Continuous verification, evidence ledger, plain-English and auditor reports, and a shareable signed passport are available to SPR customers.

See plans   Review your own repository free

Software Passport Registry Ltd. Every number on this page was observed by SPR's own scan of the public repository at the commit shown; nothing is estimated or vendor-supplied. Absence of a finding is not proof of safety. Terms · Privacy