{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-07-20T14:37:29.537Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-07-20T14:36:19.763Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":30,"completeTreeCount":29,"incompleteTreeCount":1,"lockfileRepositoryCount":17,"sbomRepositoryCount":4,"artifactRepositoryCount":20,"resolvedRepositoryCount":29,"resolvedArtifactRepositoryCount":20,"dependencyFileCount":33,"parsedFileCount":32,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4205,"metadataResolvedCount":4191,"metadataNotFoundCount":14,"osvEvaluatedVersionCount":4205,"codeRadarRepositoryCount":30},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":5000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":30,"packageCount":2831,"aiPackageCount":41,"resolvedComponentCount":7181,"resolvedVersionCount":4205,"providerExposureRepositoryCount":7,"licenseExpressionCount":57,"knownLicensePackageCount":2796,"unknownLicensePackageCount":35,"advisoryCount":572,"matchedAdvisoryRepositoryCount":25,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":18,"repositoryShare":0.6}},"kind":"paket","entity":{"id":"package:pypi:dspy","slug":"dspy-70e56922","identity":"pypi:dspy","ecosystem":"pypi","name":"dspy","label":"DSPy","category":"orchestration","aiRelevant":true,"provider":null,"repositoryCount":3,"occurrenceCount":3,"directRepositoryCount":0,"versionCount":3,"licenseExpressions":["MIT"],"advisoryIds":["GHSA-vvw2-h478-xwr3"],"advisoryCount":1,"verifiedAttestation":false,"repositories":[{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["2.6.27"],"evidenceCount":1},{"id":"opencode:5012","slug":"opencode-5012","name":"LLM Testframework","pathWithNamespace":"uba-ki-lab/llm-testframework","versions":["2.6.23"],"evidenceCount":1},{"id":"opencode:4112","slug":"opencode-4112","name":"Objection management","pathWithNamespace":"uba-ki-lab/objection-management","versions":["2.5.43"],"evidenceCount":1}],"versions":[{"version":"2.5.43","repositoryCount":1,"occurrenceCount":1,"ageDays":583,"advisoryIds":["GHSA-vvw2-h478-xwr3"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-12-13T15:02:33Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT"],"advisoryIds":["GHSA-vvw2-h478-xwr3","PYSEC-2026-1318"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/stanfordnlp/dsp"}],"relatedProjects":[{"id":"github.com/stanfordnlp/dsp","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"2.6.23","repositoryCount":1,"occurrenceCount":1,"ageDays":440,"advisoryIds":["GHSA-vvw2-h478-xwr3"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-05-05T15:20:19Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT"],"advisoryIds":["GHSA-vvw2-h478-xwr3","PYSEC-2026-1318"],"links":[{"label":"HOMEPAGE","url":"https://github.com/stanfordnlp/dspy"},{"label":"SOURCE_REPO","url":"https://github.com/stanfordnlp/dspy"}],"relatedProjects":[{"id":"github.com/stanfordnlp/dspy","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"2.6.27","repositoryCount":1,"occurrenceCount":1,"ageDays":411,"advisoryIds":["GHSA-vvw2-h478-xwr3"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-06-03T17:47:11Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT"],"advisoryIds":["GHSA-vvw2-h478-xwr3","PYSEC-2026-1318"],"links":[{"label":"HOMEPAGE","url":"https://github.com/stanfordnlp/dspy"},{"label":"SOURCE_REPO","url":"https://github.com/stanfordnlp/dspy"}],"relatedProjects":[{"id":"github.com/stanfordnlp/dspy","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}}]},"evidence":{"occurrences":[{"id":"component:df6c47c7538956a2d075079a","repositoryId":"opencode:5530","repositorySlug":"opencode-5530","repositoryName":"GSA Extraction","repositoryPathWithNamespace":"uba-ki-lab/gsa-extraction","ecosystem":"pypi","name":"dspy","identity":"pypi:dspy","version":"2.6.27","versionKey":"pypi:dspy@2.6.27","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"fbb23733e647554b5678500b3f17f13bac7f77f5","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/gsa-extraction/-/blob/f5161e79d3f8c53877f9b1b0d72e1c10bff775ba/uv.lock","commitSha":"f5161e79d3f8c53877f9b1b0d72e1c10bff775ba"},{"id":"component:75a50b1bed116b35307c93c6","repositoryId":"opencode:5012","repositorySlug":"opencode-5012","repositoryName":"LLM Testframework","repositoryPathWithNamespace":"uba-ki-lab/llm-testframework","ecosystem":"pypi","name":"dspy","identity":"pypi:dspy","version":"2.6.23","versionKey":"pypi:dspy@2.6.23","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"b4c29eab16a40db016821e4ea567956048a046ea","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/llm-testframework/-/blob/e8d6e99a1fa63b264e727acb553ed9b1499789b1/uv.lock","commitSha":"e8d6e99a1fa63b264e727acb553ed9b1499789b1"},{"id":"component:55714d284dc273d83d161bfe","repositoryId":"opencode:4112","repositorySlug":"opencode-4112","repositoryName":"Objection management","repositoryPathWithNamespace":"uba-ki-lab/objection-management","ecosystem":"pypi","name":"dspy","identity":"pypi:dspy","version":"2.5.43","versionKey":"pypi:dspy@2.5.43","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"8515db65670904208e99397a2d7878af759c74f3","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/objection-management/-/blob/5c1425bf9990cf12c5ae8ada47d249710703af18/uv.lock","commitSha":"5c1425bf9990cf12c5ae8ada47d249710703af18"}],"occurrenceCount":3},"related":{"repositories":[{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["2.6.27"],"evidenceCount":1},{"id":"opencode:5012","slug":"opencode-5012","name":"LLM Testframework","pathWithNamespace":"uba-ki-lab/llm-testframework","versions":["2.6.23"],"evidenceCount":1},{"id":"opencode:4112","slug":"opencode-4112","name":"Objection management","pathWithNamespace":"uba-ki-lab/objection-management","versions":["2.5.43"],"evidenceCount":1}],"vulnerabilities":[{"id":"GHSA-vvw2-h478-xwr3","slug":"ghsa-vvw2-h478-xwr3-e8568ce6","dossier":false,"summary":"DSPy does not properly restrict file reads","aliases":["CVE-2025-12695","PYSEC-2026-1318"],"sourceIds":["GHSA-vvw2-h478-xwr3","PYSEC-2026-1318"],"published":"2025-11-04T15:31:35Z","modified":"2026-07-07T17:57:24.503135806Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12695"},{"type":"PACKAGE","url":"https://github.com/stanfordnlp/dspy"},{"type":"WEB","url":"https://research.jfrog.com/vulnerabilities/dspy-sandbox-escape-arbitrary-file-read-jfsa-2025-001495652"},{"type":"PACKAGE","url":"https://pypi.org/project/dspy"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vvw2-h478-xwr3"}],"versionKeys":["pypi:dspy@2.5.43","pypi:dspy@2.6.23","pypi:dspy@2.6.27"],"packageCount":1,"repositoryCount":3}]}}