GraphCanon
Home/dolly/Trust report

Trust and health report

dolly - trust report

Sourced, dated trust signals - maintenance label posture, repository provenance, and security scan status. Not a composite safety grade.

GraphCanon updated today · GitHub synced today

Maintenance

Recency and activity heuristics from public GitHub metadata (maintenance label, momentum); methodology: github_public_v1.

Dormant18% signal

last push 1107d ago

Provenance

Repository identity and fork provenance (github_public_v1).

Security scan

Dependency advisory security scan when a lockfile is present. Not a full code audit.

Status
69 low
Last scan
today
Scanner
osv@v1

Findings

GHSA-8cp5-3rf8-8gfh
deepspeed@0.8.3 · requirements.txt
PYSEC-2024-109
deepspeed@0.8.3 · requirements.txt
GHSA-2qmj-7962-cjq8
langchain@0.0.139 · requirements.txt
GHSA-3644-q5cj-c5c7
langchain@0.0.139 · requirements.txt
GHSA-3hjh-jh2h-vrg6
langchain@0.0.139 · requirements.txt
GHSA-45pg-36p6-83v9
langchain@0.0.139 · requirements.txt
GHSA-57fc-8q82-gfp3
langchain@0.0.139 · requirements.txt
GHSA-655w-fm8m-m478
langchain@0.0.139 · requirements.txt
GHSA-6643-h7h5-x9wh
langchain@0.0.139 · requirements.txt
GHSA-6h8p-4hx9-w66c
langchain@0.0.139 · requirements.txt
GHSA-7gfq-f96f-g85j
langchain@0.0.139 · requirements.txt
GHSA-7q94-qpjr-xpgm
langchain@0.0.139 · requirements.txt
GHSA-8h5w-f6q9-wg35
langchain@0.0.139 · requirements.txt
GHSA-92j5-3459-qgp4
langchain@0.0.139 · requirements.txt
GHSA-f73w-4m7g-ch9x
langchain@0.0.139 · requirements.txt
GHSA-fj32-q626-pjjc
langchain@0.0.139 · requirements.txt
GHSA-gr75-jv2w-4656
langchain@0.0.139 · requirements.txt
GHSA-gwqq-6vq7-5j86
langchain@0.0.139 · requirements.txt
GHSA-h59x-p739-982c
langchain@0.0.139 · requirements.txt
GHSA-h9j7-5xvc-qhg5
langchain@0.0.139 · requirements.txt
GHSA-prgp-w7vf-ch62
langchain@0.0.139 · requirements.txt
GHSA-rgp8-pm28-3759
langchain@0.0.139 · requirements.txt
GHSA-x32c-59v5-h7fg
langchain@0.0.139 · requirements.txt
PYSEC-2023-109
langchain@0.0.139 · requirements.txt
PYSEC-2023-110
langchain@0.0.139 · requirements.txt
PYSEC-2023-138
langchain@0.0.139 · requirements.txt
PYSEC-2023-145
langchain@0.0.139 · requirements.txt
PYSEC-2023-146
langchain@0.0.139 · requirements.txt
PYSEC-2023-147
langchain@0.0.139 · requirements.txt
PYSEC-2023-151
langchain@0.0.139 · requirements.txt
PYSEC-2023-162
langchain@0.0.139 · requirements.txt
PYSEC-2023-205
langchain@0.0.139 · requirements.txt
PYSEC-2023-91
langchain@0.0.139 · requirements.txt
PYSEC-2023-92
langchain@0.0.139 · requirements.txt
PYSEC-2023-98
langchain@0.0.139 · requirements.txt
PYSEC-2024-118
langchain@0.0.139 · requirements.txt
PYSEC-2024-43
langchain@0.0.139 · requirements.txt
PYSEC-2026-1507
langchain@0.0.139 · requirements.txt
PYSEC-2026-1508
langchain@0.0.139 · requirements.txt
PYSEC-2026-1509
langchain@0.0.139 · requirements.txt
PYSEC-2026-1510
langchain@0.0.139 · requirements.txt
PYSEC-2026-372
langchain@0.0.139 · requirements.txt
GHSA-3749-ghw9-m3mg
torch@1.13.1 · requirements.txt
GHSA-53q9-r3pm-6pq6
torch@1.13.1 · requirements.txt
GHSA-5pcm-hx3q-hm94
torch@1.13.1 · requirements.txt
GHSA-887c-mr87-cxwp
torch@1.13.1 · requirements.txt
GHSA-c678-jfcj-6jmf
torch@1.13.1 · requirements.txt
GHSA-f4hp-rmr7-r7v8
torch@1.13.1 · requirements.txt
GHSA-pg7h-5qx3-wjr3
torch@1.13.1 · requirements.txt
GHSA-qfhq-4f3w-5fph
torch@1.13.1 · requirements.txt
GHSA-rrmf-rvhw-rf47
torch@1.13.1 · requirements.txt
GHSA-vgrw-7cvw-pwgx
torch@1.13.1 · requirements.txt
GHSA-x3gm-94wq-g975
torch@1.13.1 · requirements.txt
PYSEC-2024-250
torch@1.13.1 · requirements.txt
PYSEC-2024-251
torch@1.13.1 · requirements.txt
PYSEC-2024-252
torch@1.13.1 · requirements.txt
PYSEC-2024-259
torch@1.13.1 · requirements.txt
PYSEC-2025-191
torch@1.13.1 · requirements.txt
PYSEC-2025-198
torch@1.13.1 · requirements.txt
PYSEC-2025-203
torch@1.13.1 · requirements.txt
PYSEC-2025-204
torch@1.13.1 · requirements.txt
PYSEC-2025-205
torch@1.13.1 · requirements.txt
PYSEC-2025-206
torch@1.13.1 · requirements.txt
PYSEC-2025-207
torch@1.13.1 · requirements.txt
PYSEC-2025-208
torch@1.13.1 · requirements.txt
PYSEC-2025-209
torch@1.13.1 · requirements.txt
PYSEC-2025-41
torch@1.13.1 · requirements.txt
PYSEC-2026-139
torch@1.13.1 · requirements.txt
PYSEC-2026-1970
torch@1.13.1 · requirements.txt

Method and caveats:these are sourced, dated heuristics from public GitHub data and optional dependency scans. A status like "no criticals found on 2026-07-11" is not a guarantee of safety. Read the full trust methodology · JSON report at /api/graphcanon/tools/databrickslabs-dolly/trust.

Common questions

Is dolly maintained?
GraphCanon rates dolly "Dormant" (18% maintenance signal from public GitHub metadata, computed today). Last push was 1107 days ago. This is a recency heuristic, not a guarantee the project will stay maintained.
Is dolly safe to use?
Last scanned today (deps profile). Status: 69 low - 69 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify dolly as safe - review maintenance, provenance, and scan findings on this page before adopting.
Is dolly a fork?
No. dolly is not flagged as a fork in GitHub metadata at the time of the last refresh.
Does dolly have known security vulnerabilities?
Last scanned today (deps profile). Status: 69 low - 69 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report.
How often is the dolly trust report updated?
Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed today (methodology github_public_v1).
What does GraphCanon never claim about dolly?
We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for dolly. Signals are sourced heuristics with explicit limits - see trust methodology.
How does GraphCanon assess trust for dolly?
Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read trust methodology for full scope and limits.