Trust and health report
ComoRAG - trust report
Sourced, dated trust signals - maintenance label posture, repository provenance, and security scan status. Not a composite safety grade.
GraphCanon updated today · GitHub synced today
Maintenance
Recency and activity heuristics from public GitHub metadata (maintenance label, momentum); methodology: github_public_v1.
Slowing36% signal
last push 317d ago
Provenance
Repository identity and fork provenance (github_public_v1).
- GitHub repo id: 1039974363
- Not a fork
- Personal account
- Computed today
Security scan
Dependency advisory security scan when a lockfile is present. Not a full code audit.
- Status
- 106 low
- Last scan
- today
- Scanner
- osv@v1
Findings
GHSA-2fqr-mr3j-6wp8
aiohttp@3.11.18 · requirements.txt
GHSA-2vrm-gr82-f7m5
aiohttp@3.11.18 · requirements.txt
GHSA-3wq7-rqq7-wx6j
aiohttp@3.11.18 · requirements.txt
GHSA-4fvr-rgm6-gqmc
aiohttp@3.11.18 · requirements.txt
GHSA-4m7w-qmgq-4wj5
aiohttp@3.11.18 · requirements.txt
GHSA-54jq-c3m8-4m76
aiohttp@3.11.18 · requirements.txt
GHSA-63hf-3vf5-4wqf
aiohttp@3.11.18 · requirements.txt
GHSA-63hw-fmq6-xxg2
aiohttp@3.11.18 · requirements.txt
GHSA-69f9-5gxw-wvc2
aiohttp@3.11.18 · requirements.txt
GHSA-6jhg-hg63-jvvf
aiohttp@3.11.18 · requirements.txt
GHSA-6mq8-rvhq-8wgg
aiohttp@3.11.18 · requirements.txt
GHSA-9548-qrrj-x5pj
aiohttp@3.11.18 · requirements.txt
GHSA-966j-vmvw-g2g9
aiohttp@3.11.18 · requirements.txt
GHSA-9x8q-7h8h-wcw9
aiohttp@3.11.18 · requirements.txt
GHSA-c427-h43c-vf67
aiohttp@3.11.18 · requirements.txt
GHSA-fh55-r93g-j68g
aiohttp@3.11.18 · requirements.txt
GHSA-g3cq-j2xw-wf74
aiohttp@3.11.18 · requirements.txt
GHSA-g84x-mcqj-x9qq
aiohttp@3.11.18 · requirements.txt
GHSA-hcc4-c3v8-rx92
aiohttp@3.11.18 · requirements.txt
GHSA-hg6j-4rv6-33pg
aiohttp@3.11.18 · requirements.txt
GHSA-hpj7-wq8m-9hgp
aiohttp@3.11.18 · requirements.txt
GHSA-jg22-mg44-37j8
aiohttp@3.11.18 · requirements.txt
GHSA-jj3x-wxrx-4x23
aiohttp@3.11.18 · requirements.txt
GHSA-m5qp-6w8w-w647
aiohttp@3.11.18 · requirements.txt
GHSA-m6qw-4cw2-hm4m
aiohttp@3.11.18 · requirements.txt
GHSA-mqqc-3gqh-h2x8
aiohttp@3.11.18 · requirements.txt
GHSA-mwh4-6h8g-pg8w
aiohttp@3.11.18 · requirements.txt
GHSA-p998-jp59-783m
aiohttp@3.11.18 · requirements.txt
GHSA-w2fm-2cpv-w7v5
aiohttp@3.11.18 · requirements.txt
GHSA-xcgm-r5h9-7989
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1097
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1099
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1100
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1101
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1104
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1105
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1106
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1107
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-1109
aiohttp@3.11.18 · requirements.txt
PYSEC-2026-237
aiohttp@3.11.18 · requirements.txt
GHSA-w8v5-vhqr-4h9v
diskcache@5.6.3 · requirements.txt
GHSA-qmgc-5h2g-mvrw
filelock@3.18.0 · requirements.txt
GHSA-w853-jp5j-5j7f
filelock@3.18.0 · requirements.txt
PYSEC-2026-1374
filelock@3.18.0 · requirements.txt
PYSEC-2026-1375
filelock@3.18.0 · requirements.txt
GHSA-7545-fcxq-7j24
GitPython@3.1.44 · requirements.txt
GHSA-mv93-w799-cj2w
GitPython@3.1.44 · requirements.txt
GHSA-rpm5-65cw-6hj4
GitPython@3.1.44 · requirements.txt
GHSA-v87r-6q3f-2j67
GitPython@3.1.44 · requirements.txt
GHSA-x2qx-6953-8485
GitPython@3.1.44 · requirements.txt
GHSA-65pc-fj4g-8rjx
idna@3.10 · requirements.txt
PYSEC-2026-215
idna@3.10 · requirements.txt
GHSA-6v7p-g79w-8964
msgpack@1.1.0 · requirements.txt
GHSA-469j-vmhf-r6v7
nltk@3.9.1 · requirements.txt
GHSA-68j8-pq59-fqgm
nltk@3.9.1 · requirements.txt
GHSA-7p94-766c-hgjp
nltk@3.9.1 · requirements.txt
GHSA-gfwx-w7gr-fvh7
nltk@3.9.1 · requirements.txt
GHSA-h8wq-7xc4-p3qx
nltk@3.9.1 · requirements.txt
GHSA-jm6w-m3j8-898g
nltk@3.9.1 · requirements.txt
GHSA-p4gq-832x-fm9v
nltk@3.9.1 · requirements.txt
GHSA-rf74-v2fm-23pw
nltk@3.9.1 · requirements.txt
PYSEC-2026-2078
nltk@3.9.1 · requirements.txt
PYSEC-2026-2085
nltk@3.9.1 · requirements.txt
PYSEC-2026-597
nltk@3.9.1 · requirements.txt
PYSEC-2026-96
nltk@3.9.1 · requirements.txt
PYSEC-2026-97
nltk@3.9.1 · requirements.txt
PYSEC-2026-98
nltk@3.9.1 · requirements.txt
PYSEC-2026-99
nltk@3.9.1 · requirements.txt
GHSA-5xmw-vc9v-4wf2
pillow@11.2.1 · requirements.txt
GHSA-cfh3-3jmp-rvhc
pillow@11.2.1 · requirements.txt
GHSA-pwv6-vv43-88gr
pillow@11.2.1 · requirements.txt
GHSA-r73j-pqj5-w3x7
pillow@11.2.1 · requirements.txt
GHSA-whj4-6x5x-4v2j
pillow@11.2.1 · requirements.txt
GHSA-wjx4-4jcj-g98j
pillow@11.2.1 · requirements.txt
GHSA-xg8h-j46f-w952
pillow@11.2.1 · requirements.txt
PYSEC-2025-61
pillow@11.2.1 · requirements.txt
PYSEC-2026-165
pillow@11.2.1 · requirements.txt
GHSA-7gcm-g887-7qv7
protobuf@4.25.7 · requirements.txt
GHSA-8qvm-5x2c-j2w7
protobuf@4.25.7 · requirements.txt
PYSEC-2026-1805
protobuf@4.25.7 · requirements.txt
PYSEC-2026-1806
protobuf@4.25.7 · requirements.txt
GHSA-rgxp-2hwp-jwgg
pyarrow@19.0.1 · requirements.txt
PYSEC-2026-113
pyarrow@19.0.1 · requirements.txt
GHSA-63vm-454h-vhhq
pyasn1@0.6.1 · requirements.txt
GHSA-jr27-m4p2-rc6r
pyasn1@0.6.1 · requirements.txt
PYSEC-2026-1810
pyasn1@0.6.1 · requirements.txt
GHSA-5239-wwwm-4pmq
Pygments@2.19.1 · requirements.txt
GHSA-mf9w-mj56-hr94
python-dotenv@1.1.0 · requirements.txt
GHSA-5rvq-cxj2-64vf
python-multipart@0.0.20 · requirements.txt
GHSA-6jv3-5f52-599m
python-multipart@0.0.20 · requirements.txt
GHSA-mj87-hwqh-73pj
python-multipart@0.0.20 · requirements.txt
GHSA-pp6c-gr5w-3c5g
python-multipart@0.0.20 · requirements.txt
GHSA-v9pg-7xvm-68hf
python-multipart@0.0.20 · requirements.txt
GHSA-vffw-93wf-4j4q
python-multipart@0.0.20 · requirements.txt
GHSA-wp53-j4wj-2cfg
python-multipart@0.0.20 · requirements.txt
PYSEC-2026-1852
python-multipart@0.0.20 · requirements.txt
GHSA-6wgj-66m2-xxp2
ray@2.45.0 · requirements.txt
GHSA-gx77-xgc2-4888
ray@2.45.0 · requirements.txt
GHSA-q279-jhrf-cc6v
ray@2.45.0 · requirements.txt
GHSA-q5fh-2hc8-f6rq
ray@2.45.0 · requirements.txt
PYSEC-2026-517
ray@2.45.0 · requirements.txt
PYSEC-2026-518
ray@2.45.0 · requirements.txt
PYSEC-2026-520
ray@2.45.0 · requirements.txt
GHSA-9hjg-9r4m-mvj7
requests@2.32.3 · requirements.txt
GHSA-gc5v-m9x4-r6x2
requests@2.32.3 · requirements.txt
PYSEC-2026-1872
requests@2.32.3 · requirements.txt
Method and caveats:these are sourced, dated heuristics from public GitHub data and optional dependency scans. A status like "no criticals found on 2026-07-11" is not a guarantee of safety. Read the full trust methodology · JSON report at /api/graphcanon/tools/eternityjune25-comorag/trust.
Common questions
- Is ComoRAG maintained?
- GraphCanon rates ComoRAG "Slowing" (36% maintenance signal from public GitHub metadata, computed today). Last push was 317 days ago. This is a recency heuristic, not a guarantee the project will stay maintained.
- Is ComoRAG safe to use?
- Last scanned today (deps profile). Status: 106 low - 106 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify ComoRAG as safe - review maintenance, provenance, and scan findings on this page before adopting.
- Is ComoRAG a fork?
- No. ComoRAG is not flagged as a fork in GitHub metadata at the time of the last refresh.
- Does ComoRAG have known security vulnerabilities?
- Last scanned today (deps profile). Status: 106 low - 106 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report.
- How often is the ComoRAG trust report updated?
- Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed today (methodology github_public_v1).
- What does GraphCanon never claim about ComoRAG?
- We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for ComoRAG. Signals are sourced heuristics with explicit limits - see trust methodology.
- How does GraphCanon assess trust for ComoRAG?
- Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read trust methodology for full scope and limits.