AI Assessment
VERDICT
Not production-ready. The repository has 2 critical dependency vulnerabilities and 39 high-severity CVEs across lock files, plus 91 code quality issues including functions with cyclomatic complexity exceeding 70. Dependency hygiene is severely degraded.
TOP RISKS
→ CVE-2025-43859 in h11@0.14.0 flagged in docs/Pipfile.lock — critical vulnerability in HTTP library
→ CVE-2025-68664 in langchain-core@1.0.4 flagged in uv.lock — critical vulnerability in core dependency
→ Multiple high-severity CVEs in urllib3@1.26.6 detected across docs/Pipfile.lock, docs/requirements.txt, and uv.lock (CVE-2025-66418, CVE-2025-66471, CVE-2026-21441, CVE-2023-43804, CVE-2025-50181, CVE-2023-45803, CVE-2024-37891)
→ High cyclomatic complexity flagged in dspy/teleprompt/grpo.py, dspy/teleprompt/simba.py, and dspy/teleprompt/gepa/gepa_utils.py with compile functions reaching CCN 74
→ Duplicated code blocks (41 lines) detected across test files including tests/predict/test_react.py:358 and tests/teleprompt/test_gepa_instruction_proposer.py:305
WHAT TO FIX FIRST
Upgrade urllib3 across all lock files (docs/Pipfile.lock, docs/requirements.txt, uv.lock). The scanner detected 7 distinct CVEs in version 1.26.6. This single dependency appears in multiple manifests and fixing it would eliminate roughly 15-20 findings immediately.
Note: Verify these CVE findings against actual code usage—some may be false positives if the vulnerable code paths are not exercised. The cyclomatic complexity findings warrant manual review to confirm they reflect actual maintainability issues.
Category Breakdown
Findings(174 in 67 groups)
h11: h11 accepts some malformed Chunked-Encoding bodies | Fix available: 0.16.0 | Package: h11 (pipenv) | https://avd.aquasec.com/nvd/cve-2025-43859
Affected files
langchain-core: LangChain: Arbitrary code execution via serialization injection | Fix available: 1.2.5, 0.3.81 | Package: langchain-core (uv) | https://avd.aquasec.com/nvd/cve-2025-68664
Affected files
Function "compile( self" has a cyclomatic complexity of 74 (255 lines, 6 parameters). This function is extremely complex and should be refactored into smaller functions.
Affected files
urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | Fix available: 2.6.0 | Package: urllib3 (pipenv) | https://avd.aquasec.com/nvd/cve-2025-66418
Affected files
urllib3: urllib3 Streaming API improperly handles highly compressed data | Fix available: 2.6.0 | Package: urllib3 (pipenv) | https://avd.aquasec.com/nvd/cve-2025-66471
Affected files
urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) | Fix available: 2.6.3 | Package: urllib3 (pipenv) | https://avd.aquasec.com/nvd/cve-2026-21441
Affected files
aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb | Fix available: 3.13.3 | Package: aiohttp (pipenv) | https://avd.aquasec.com/nvd/cve-2025-69223
Affected files
pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image | Fix available: 12.1.1 | Package: pillow (pipenv) | https://avd.aquasec.com/nvd/cve-2026-25990
Affected files
python-urllib3: Cookie request header isn't stripped during cross-origin redirects | Fix available: 2.0.6, 1.26.17 | Package: urllib3 (pipenv) | https://avd.aquasec.com/nvd/cve-2023-43804
Affected files
cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves | Fix available: 46.0.5 | Package: cryptography (uv) | https://avd.aquasec.com/nvd/cve-2026-26007
Affected files
Share your ShipScanner
Show the world your code quality. Your report has a beautiful preview image built in.
Embed Trust Badge
Show your code quality score in your README. The badge updates automatically every time you re-scan.
[](https://shipscanner.dev/report/cmmt8i52k0005k004d0vz60s4)