--- title: "wanwu trust report" type: "trust-report" slug: "unicomai-wanwu" canonical_url: "https://www.graphcanon.com/tools/unicomai-wanwu/trust" computed_at: "2026-07-15T10:48:37.192Z" maintenance_label: "Very active" security_status: "findings" --- # wanwu trust report _Sourced [trust signals](/glossary/trust-and-signals/trust-signal) from public GitHub metadata and external security intelligence providers. Not a security guarantee._ ## Maintenance - Label: Very active (96% recency signal) - Days since last push: 0 - Last release: 2026-07-10T10:14:53Z - Releases (90d): 11 - Methodology: github_public_v1 ## Provenance - GitHub repo id: 997136302 - Not a fork - Owner type: User - Computed at: 2026-07-15T10:48:37.192Z - Methodology: github_public_v1 ## Security intelligence - **OSV dependency advisories**: Published findings - Last query: 2026-07-15T10:48:39.453553+00:00 - Evidence: https://osv.dev/ - **deps.dev advisories**: Not queried - Evidence: https://deps.dev/ - **OpenSSF Scorecard**: Not queried - Evidence: https://api.securityscorecards.dev/projects/github.com/UnicomAI/wanwu - Note: Weekly public scans omit some checks at scale. ### Findings - **low**: GHSA-fw7p-63qq-7hpr (filippo.io/edwards25519@v1.1.0 · go.sum · osv@v1) - **low**: GO-2026-4503 (filippo.io/edwards25519@v1.1.0 · go.sum · osv@v1) - **low**: GHSA-m5vv-6r4h-3vj9 (github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.3.0 · go.sum · osv@v1) - **low**: GO-2024-2918 (github.com/Azure/azure-sdk-for-go/sdk/azidentity@v1.3.0 · go.sum · osv@v1) - **low**: GHSA-6g7g-w4f8-9c9x (github.com/buger/jsonparser@v1.1.1 · go.sum · osv@v1) - **low**: GO-2026-4514 (github.com/buger/jsonparser@v1.1.1 · go.sum · osv@v1) - **low**: GHSA-w73w-5m7g-f7qc (github.com/dgrijalva/jwt-go@v3.2.0+incompatible · go.sum · osv@v1) - **low**: GO-2020-0017 (github.com/dgrijalva/jwt-go@v3.2.0+incompatible · go.sum · osv@v1) - **low**: GHSA-q7pp-wcgr-pffx (github.com/disintegration/imaging@v1.6.2 · go.sum · osv@v1) - **low**: GHSA-wq9g-9vfc-cfq9 (github.com/getkin/kin-openapi@v0.118.0 · go.sum · osv@v1) - **low**: GO-2025-3533 (github.com/getkin/kin-openapi@v0.118.0 · go.sum · osv@v1) - **low**: GHSA-2464-8j7c-4cjm (github.com/go-viper/mapstructure/v2@v2.2.1 · go.sum · osv@v1) - **low**: GHSA-fv92-fjc5-jj9h (github.com/go-viper/mapstructure/v2@v2.2.1 · go.sum · osv@v1) - **low**: GO-2025-3787 (github.com/go-viper/mapstructure/v2@v2.2.1 · go.sum · osv@v1) - **low**: GO-2025-3900 (github.com/go-viper/mapstructure/v2@v2.2.1 · go.sum · osv@v1) - **low**: GHSA-mh63-6h87-95cp (github.com/golang-jwt/jwt@v3.2.2+incompatible · go.sum · osv@v1) - **low**: GO-2025-3553 (github.com/golang-jwt/jwt@v3.2.2+incompatible · go.sum · osv@v1) - **low**: GHSA-9jj7-4m8r-rfcm (github.com/jackc/pgx/v5@v5.5.5 · go.sum · osv@v1) - **low**: GHSA-j88v-2chj-qfwx (github.com/jackc/pgx/v5@v5.5.5 · go.sum · osv@v1) - **low**: GHSA-xgrm-4fwx-7qm8 (github.com/jackc/pgx/v5@v5.5.5 · go.sum · osv@v1) - **low**: GO-2026-4771 (github.com/jackc/pgx/v5@v5.5.5 · go.sum · osv@v1) - **low**: GO-2026-4772 (github.com/jackc/pgx/v5@v5.5.5 · go.sum · osv@v1) - **low**: GO-2026-5004 (github.com/jackc/pgx/v5@v5.5.5 · go.sum · osv@v1) ## Method and caveats These are heuristics from public GitHub data and external security intelligence providers, sourced and dated. "No published findings from this source" is not a guarantee of safety. See the full methodology: [/trust-methodology](/trust-methodology.md). ## Common questions ### Is wanwu maintained? GraphCanon rates wanwu "Very active" (96% maintenance signal from public GitHub metadata, computed today). Last push was 0 days ago. 11 GitHub releases in the last 90 days. This is a recency heuristic, not a guarantee the project will stay maintained. ### Is wanwu safe to use? Last scanned today (deps profile). Status: 23 low - 23 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. GraphCanon does not certify wanwu as safe - review maintenance, provenance, and scan findings on this page before adopting. ### Is wanwu a fork? No. wanwu is not flagged as a fork in GitHub metadata at the time of the last refresh. ### Does wanwu have known security vulnerabilities? Last scanned today (deps profile). Status: 23 low - 23 low finding(s) in the latest scan. GraphCanon does not claim the project is safe or vulnerability-free; review findings on the trust report. ### How often is the wanwu trust report updated? Trust signals refresh on GitHub ingest/refresh cycles and optional dependency/MCP scans. This report was computed today (methodology github_public_v1). ### What does GraphCanon never claim about wanwu? We never publish a composite safety grade, pen-test endorsement, or "verified secure" label for wanwu. Signals are sourced heuristics with explicit limits - see [trust methodology](/trust-methodology). ### How does GraphCanon assess trust for wanwu? Signals are sourced from public GitHub metadata and optional dependency/MCP manifest scans, each tagged with methodology version and computed date. GraphCanon does not publish a composite safety grade. Read [trust methodology](/trust-methodology) for full scope and limits. --- **Machine-readable endpoints** - JSON: [`/api/graphcanon/tools/unicomai-wanwu/trust`](/api/graphcanon/tools/unicomai-wanwu/trust) - LLM index: [/llms.txt](/llms.txt) - Full corpus: [/llms-full.txt](/llms-full.txt) _GraphCanon - The knowledge graph for AI development. https://www.graphcanon.com/_