{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-09-16T04:45:26.395Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-09-16T04:44:00.147Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":43,"completeTreeCount":42,"incompleteTreeCount":1,"lockfileRepositoryCount":23,"sbomRepositoryCount":4,"artifactRepositoryCount":26,"resolvedRepositoryCount":40,"resolvedArtifactRepositoryCount":26,"dependencyFileCount":37,"parsedFileCount":36,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4116,"metadataResolvedCount":4105,"metadataNotFoundCount":11,"osvEvaluatedVersionCount":4116,"codeRadarRepositoryCount":43},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":8000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":43,"packageCount":2457,"aiPackageCount":50,"resolvedComponentCount":7121,"resolvedVersionCount":4116,"providerExposureRepositoryCount":9,"licenseExpressionCount":55,"knownLicensePackageCount":2423,"unknownLicensePackageCount":34,"advisoryCount":795,"matchedAdvisoryRepositoryCount":37,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":23,"repositoryShare":0.5348837209302325}},"kind":"paket","entity":{"id":"package:pypi:chromadb","slug":"chromadb-4bcada2e","identity":"pypi:chromadb","ecosystem":"pypi","name":"chromadb","label":"Chroma","category":"vector-store","aiRelevant":true,"provider":null,"repositoryCount":1,"occurrenceCount":3,"directRepositoryCount":1,"versionCount":1,"licenseExpressions":["non-standard"],"advisoryIds":["GHSA-2wm9-hf6c-p5cr","GHSA-36p7-vc44-83pf","GHSA-f4j7-r4q5-qw2c","GHSA-xph7-9rjv-w5fr"],"advisoryCount":4,"verifiedAttestation":false,"repositories":[{"id":"opencode:11300","slug":"opencode-11300","name":"URBAN.KI UrbanShieldAI","pathWithNamespace":"vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-urbanshieldai","versions":["1.0.12"],"evidenceCount":3}],"versions":[{"version":"1.0.12","repositoryCount":1,"occurrenceCount":3,"ageDays":473,"advisoryIds":["GHSA-2wm9-hf6c-p5cr","GHSA-36p7-vc44-83pf","GHSA-f4j7-r4q5-qw2c","GHSA-xph7-9rjv-w5fr"],"metadata":{"state":"resolved","checkedAt":"2026-09-16T04:45:26.395Z","publishedAt":"2025-05-31T00:18:58Z","deprecated":false,"deprecatedReason":null,"licenses":["non-standard"],"advisoryIds":["GHSA-2wm9-hf6c-p5cr","GHSA-36p7-vc44-83pf","GHSA-f4j7-r4q5-qw2c","GHSA-xph7-9rjv-w5fr","PYSEC-2026-311","PYSEC-2026-3813","PYSEC-2026-3814","PYSEC-2026-3815"],"links":[{"label":"HOMEPAGE","url":"https://github.com/chroma-core/chroma"},{"label":"ISSUE_TRACKER","url":"https://github.com/chroma-core/chroma/issues"},{"label":"SOURCE_REPO","url":"https://github.com/chroma-core/chroma"}],"relatedProjects":[{"id":"github.com/chroma-core/chroma","relationType":"ISSUE_TRACKER","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/chroma-core/chroma","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}}]},"evidence":{"occurrences":[{"id":"component:f53e2910be11a68be7482a3b","repositoryId":"opencode:11300","repositorySlug":"opencode-11300","repositoryName":"URBAN.KI UrbanShieldAI","repositoryPathWithNamespace":"vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-urbanshieldai","ecosystem":"pypi","name":"chromadb","identity":"pypi:chromadb","version":"1.0.12","versionKey":"pypi:chromadb@1.0.12","direct":true,"development":false,"sourceKind":"exact-manifest-pin","filePath":"asrp_dir/requirements.txt","blobSha":"1123e44ab8a9a3f12dc3c2b1022686f0d7d178c8","sourceUrl":"https://gitlab.opencode.de/vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-urbanshieldai/-/blob/a69008c9aa95148a933a3b7dc6c2f001bfb3b7b1/asrp_dir/requirements.txt","commitSha":"a69008c9aa95148a933a3b7dc6c2f001bfb3b7b1"},{"id":"component:352aa75322893fbe9a61e4da","repositoryId":"opencode:11300","repositorySlug":"opencode-11300","repositoryName":"URBAN.KI UrbanShieldAI","repositoryPathWithNamespace":"vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-urbanshieldai","ecosystem":"pypi","name":"chromadb","identity":"pypi:chromadb","version":"1.0.12","versionKey":"pypi:chromadb@1.0.12","direct":true,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements-file/requirements-docker.txt","blobSha":"359fe79592e2869ec844c610b934f1c2e91d4842","sourceUrl":"https://gitlab.opencode.de/vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-urbanshieldai/-/blob/a69008c9aa95148a933a3b7dc6c2f001bfb3b7b1/requirements-file/requirements-docker.txt","commitSha":"a69008c9aa95148a933a3b7dc6c2f001bfb3b7b1"},{"id":"component:34d222f1d36cde02627467db","repositoryId":"opencode:11300","repositorySlug":"opencode-11300","repositoryName":"URBAN.KI UrbanShieldAI","repositoryPathWithNamespace":"vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-urbanshieldai","ecosystem":"pypi","name":"chromadb","identity":"pypi:chromadb","version":"1.0.12","versionKey":"pypi:chromadb@1.0.12","direct":true,"development":false,"sourceKind":"exact-manifest-pin","filePath":"requirements-file/requirements.txt","blobSha":"d8eeaa4ce4a4e67cd4ee8a59e6cc6430b725b4d3","sourceUrl":"https://gitlab.opencode.de/vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-urbanshieldai/-/blob/a69008c9aa95148a933a3b7dc6c2f001bfb3b7b1/requirements-file/requirements.txt","commitSha":"a69008c9aa95148a933a3b7dc6c2f001bfb3b7b1"}],"occurrenceCount":3},"related":{"repositories":[{"id":"opencode:11300","slug":"opencode-11300","name":"URBAN.KI UrbanShieldAI","pathWithNamespace":"vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-urbanshieldai","versions":["1.0.12"],"evidenceCount":3}],"vulnerabilities":[{"id":"GHSA-2wm9-hf6c-p5cr","slug":"ghsa-2wm9-hf6c-p5cr-4e2f7d91","dossier":false,"summary":"ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection","aliases":["CVE-2026-45830","PYSEC-2026-3813"],"sourceIds":["GHSA-2wm9-hf6c-p5cr","PYSEC-2026-3813"],"published":"2026-06-12T18:31:56Z","modified":"2026-09-10T12:25:31.394776670Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45830"},{"type":"WEB","url":"https://github.com/chroma-core/chroma/issues/7588"},{"type":"WEB","url":"https://github.com/chroma-core/chroma/pull/7602"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-45830"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488408"},{"type":"PACKAGE","url":"https://github.com/chroma-core/chroma"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45830.json"},{"type":"WEB","url":"https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb"},{"type":"PACKAGE","url":"https://pypi.org/project/chromadb"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2wm9-hf6c-p5cr"}],"versionKeys":["pypi:chromadb@1.0.12"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-36p7-vc44-83pf","slug":"ghsa-36p7-vc44-83pf-c961d4d6","dossier":false,"summary":"ChromaDB has a code injection vulnerability","aliases":["CVE-2026-45833","PYSEC-2026-3814"],"sourceIds":["GHSA-36p7-vc44-83pf","PYSEC-2026-3814"],"published":"2026-06-12T18:31:56Z","modified":"2026-09-10T12:25:44.502926958Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45833"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-45833"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488430"},{"type":"PACKAGE","url":"https://github.com/chroma-core/chroma"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45833.json"},{"type":"WEB","url":"https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-5"},{"type":"PACKAGE","url":"https://pypi.org/project/chromadb"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-36p7-vc44-83pf"}],"versionKeys":["pypi:chromadb@1.0.12"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f4j7-r4q5-qw2c","slug":"ghsa-f4j7-r4q5-qw2c-1f0326e9","dossier":false,"summary":"ChromaDB Python project has a pre-authentication code injection vulnerability","aliases":["CVE-2026-45829","PYSEC-2026-311"],"sourceIds":["GHSA-f4j7-r4q5-qw2c","PYSEC-2026-311"],"published":"2026-05-18T18:31:30Z","modified":"2026-07-01T20:22:50.354214Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45829"},{"type":"WEB","url":"https://github.com/chroma-core/chroma/issues/6717"},{"type":"PACKAGE","url":"https://github.com/chroma-core/chroma"},{"type":"WEB","url":"https://www.hiddenlayer.com/research/chromatoast-served-pre-auth"},{"type":"PACKAGE","url":"https://pypi.org/project/chromadb"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f4j7-r4q5-qw2c"}],"versionKeys":["pypi:chromadb@1.0.12"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-xph7-9rjv-w5fr","slug":"ghsa-xph7-9rjv-w5fr-77473daf","dossier":false,"summary":"ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies to","aliases":["CVE-2026-45831","PYSEC-2026-3815"],"sourceIds":["GHSA-xph7-9rjv-w5fr","PYSEC-2026-3815"],"published":"2026-06-12T18:31:56Z","modified":"2026-09-10T12:25:45.510140945Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45831"},{"type":"WEB","url":"https://github.com/chroma-core/chroma/issues/7588"},{"type":"WEB","url":"https://github.com/chroma-core/chroma/pull/7602"},{"type":"PACKAGE","url":"https://github.com/chroma-core/chroma"},{"type":"WEB","url":"https://www.hiddenlayer.com/sai-security-advisory/2026-06-chromadb-3"},{"type":"PACKAGE","url":"https://pypi.org/project/chromadb"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xph7-9rjv-w5fr"}],"versionKeys":["pypi:chromadb@1.0.12"],"packageCount":1,"repositoryCount":1}]}}