{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-07-20T14:37:29.537Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-07-20T14:36:19.763Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":30,"completeTreeCount":29,"incompleteTreeCount":1,"lockfileRepositoryCount":17,"sbomRepositoryCount":4,"artifactRepositoryCount":20,"resolvedRepositoryCount":29,"resolvedArtifactRepositoryCount":20,"dependencyFileCount":33,"parsedFileCount":32,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4205,"metadataResolvedCount":4191,"metadataNotFoundCount":14,"osvEvaluatedVersionCount":4205,"codeRadarRepositoryCount":30},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":5000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":30,"packageCount":2831,"aiPackageCount":41,"resolvedComponentCount":7181,"resolvedVersionCount":4205,"providerExposureRepositoryCount":7,"licenseExpressionCount":57,"knownLicensePackageCount":2796,"unknownLicensePackageCount":35,"advisoryCount":572,"matchedAdvisoryRepositoryCount":25,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":18,"repositoryShare":0.6}},"kind":"paket","entity":{"id":"package:pypi:tornado","slug":"tornado-ab0f364e","identity":"pypi:tornado","ecosystem":"pypi","name":"tornado","label":"tornado","category":null,"aiRelevant":false,"provider":null,"repositoryCount":7,"occurrenceCount":10,"directRepositoryCount":0,"versionCount":6,"licenseExpressions":["Apache-2.0"],"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-7cx3-6m66-7c5m","GHSA-cx3h-4qpv-8hc9","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","PYSEC-2025-265","PYSEC-2025-266","PYSEC-2025-267"],"advisoryCount":10,"verifiedAttestation":true,"repositories":[{"id":"opencode:7202","slug":"opencode-7202","name":"MUCGPT","pathWithNamespace":"landeshauptstadt-muenchen/mucgpt","versions":["6.5.7"],"evidenceCount":3},{"id":"opencode:10162","slug":"opencode-10162","name":"SmartPlanAI Anwendung","pathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung","versions":["6.5.2","6.5.5"],"evidenceCount":2},{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["6.5.1"],"evidenceCount":1},{"id":"opencode:4112","slug":"opencode-4112","name":"Objection management","pathWithNamespace":"uba-ki-lab/objection-management","versions":["6.4.2"],"evidenceCount":1},{"id":"opencode:10775","slug":"opencode-10775","name":"Ressource Efficient Computer Vision","pathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","versions":["6.5.4"],"evidenceCount":1},{"id":"opencode:5142","slug":"opencode-5142","name":"strahlenexposition","pathWithNamespace":"uba-ki-lab/strahlenexposition","versions":["6.4.2"],"evidenceCount":1},{"id":"opencode:7788","slug":"opencode-7788","name":"Workshop Green LLM Usage","pathWithNamespace":"uba-ki-lab/workshop-green-llm-usage","versions":["6.5.2"],"evidenceCount":1}],"versions":[{"version":"6.4.2","repositoryCount":2,"occurrenceCount":2,"ageDays":605,"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-7cx3-6m66-7c5m","GHSA-cx3h-4qpv-8hc9","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","PYSEC-2025-265","PYSEC-2025-266","PYSEC-2025-267"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-11-22T03:06:27Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-7cx3-6m66-7c5m","GHSA-cx3h-4qpv-8hc9","GHSA-fqwm-6jpj-5wxc","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","PYSEC-2025-265","PYSEC-2025-266","PYSEC-2025-267","PYSEC-2026-140","PYSEC-2026-1974","PYSEC-2026-2287","PYSEC-2026-3387","PYSEC-2026-3388","PYSEC-2026-3389"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/tornadoweb/tornado"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/tornado/6.4.2/tornado-6.4.2-cp38-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/tornado/6.4.2/tornado-6.4.2-cp38-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/tornadoweb/tornado","commit":"a5ecfab15e52202a46d34638aad93cddca86d87b"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"6.5.1","repositoryCount":1,"occurrenceCount":1,"ageDays":423,"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-cx3h-4qpv-8hc9","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","PYSEC-2025-265","PYSEC-2025-266","PYSEC-2025-267"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-05-22T18:15:27Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-cx3h-4qpv-8hc9","GHSA-fqwm-6jpj-5wxc","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","PYSEC-2025-265","PYSEC-2025-266","PYSEC-2025-267","PYSEC-2026-140","PYSEC-2026-2287","PYSEC-2026-3387","PYSEC-2026-3388","PYSEC-2026-3389"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/tornadoweb/tornado"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/tornado/6.5.1/tornado-6.5.1-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/tornado/6.5.1/tornado-6.5.1-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/tornadoweb/tornado","commit":"b5586f3f2956308a9dff1fba2c3ddbbbe1ab29d0"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"6.5.2","repositoryCount":2,"occurrenceCount":2,"ageDays":345,"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-cx3h-4qpv-8hc9","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","PYSEC-2025-265","PYSEC-2025-266","PYSEC-2025-267"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-08-08T18:26:50Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-cx3h-4qpv-8hc9","GHSA-fqwm-6jpj-5wxc","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","PYSEC-2025-265","PYSEC-2025-266","PYSEC-2025-267","PYSEC-2026-140","PYSEC-2026-2287","PYSEC-2026-3387","PYSEC-2026-3388","PYSEC-2026-3389"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/tornadoweb/tornado"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/tornado/6.5.2/tornado-6.5.2-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/tornado/6.5.2/tornado-6.5.2-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/tornadoweb/tornado","commit":"547e6d86972238f1f5333a85f12b17fb33626899"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"6.5.4","repositoryCount":1,"occurrenceCount":1,"ageDays":216,"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-cx3h-4qpv-8hc9","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-12-15T19:20:53Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-78cv-mqj4-43f7","GHSA-cx3h-4qpv-8hc9","GHSA-fqwm-6jpj-5wxc","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","GHSA-qjxf-f2mg-c6mc","PYSEC-2026-140","PYSEC-2026-2287","PYSEC-2026-3387","PYSEC-2026-3388","PYSEC-2026-3389"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/tornadoweb/tornado"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/tornado/6.5.4/tornado-6.5.4-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/tornado/6.5.4/tornado-6.5.4-cp39-abi3-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/tornadoweb/tornado","commit":"63d4df4eefa6750bb14efa1ebffe67b8c54fbad4"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"6.5.5","repositoryCount":1,"occurrenceCount":1,"ageDays":131,"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-cx3h-4qpv-8hc9","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-03-10T21:30:48Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":["GHSA-3x9g-8vmp-wqvf","GHSA-cx3h-4qpv-8hc9","GHSA-mgf9-4vpg-hj56","GHSA-pw6j-qg29-8w7f","PYSEC-2026-3387","PYSEC-2026-3388","PYSEC-2026-3389"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/tornadoweb/tornado"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/tornado/6.5.5/tornado-6.5.5-cp39-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/tornado/6.5.5/tornado-6.5.5-cp39-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/tornadoweb/tornado","commit":"7d6465056ceb7a054b3f64cf1c18271753b10482"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"6.5.7","repositoryCount":1,"occurrenceCount":3,"ageDays":41,"advisoryIds":[],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-06-08T17:34:41Z","deprecated":false,"deprecatedReason":null,"licenses":["Apache-2.0"],"advisoryIds":[],"links":[{"label":"SOURCE_REPO","url":"https://github.com/tornadoweb/tornado"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/tornado/6.5.7/tornado-6.5.7-cp39-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/tornadoweb/tornado","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/tornado/6.5.7/tornado-6.5.7-cp39-abi3-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/tornadoweb/tornado","commit":"48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4"}],"verifiedAttestation":true,"projectStatus":"active"}}]},"evidence":{"occurrences":[{"id":"component:0ebc7f5aeae55a8fc846df38","repositoryId":"opencode:5530","repositorySlug":"opencode-5530","repositoryName":"GSA Extraction","repositoryPathWithNamespace":"uba-ki-lab/gsa-extraction","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.5.1","versionKey":"pypi:tornado@6.5.1","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"fbb23733e647554b5678500b3f17f13bac7f77f5","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/gsa-extraction/-/blob/f5161e79d3f8c53877f9b1b0d72e1c10bff775ba/uv.lock","commitSha":"f5161e79d3f8c53877f9b1b0d72e1c10bff775ba"},{"id":"component:25284362925a0f2ac3a8d70f","repositoryId":"opencode:7202","repositorySlug":"opencode-7202","repositoryName":"MUCGPT","repositoryPathWithNamespace":"landeshauptstadt-muenchen/mucgpt","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.5.7","versionKey":"pypi:tornado@6.5.7","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"mucgpt-assistant-service/uv.lock","blobSha":"36b26ae58598809148cf87cffcc3b67380e8b928","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/mucgpt/-/blob/46f1bd0b3a36f6d7b7bb0ea110665a5955a5e7a8/mucgpt-assistant-service/uv.lock","commitSha":"46f1bd0b3a36f6d7b7bb0ea110665a5955a5e7a8"},{"id":"component:ea9ab0d043bbd9de3e117f21","repositoryId":"opencode:7202","repositorySlug":"opencode-7202","repositoryName":"MUCGPT","repositoryPathWithNamespace":"landeshauptstadt-muenchen/mucgpt","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.5.7","versionKey":"pypi:tornado@6.5.7","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"mucgpt-core-service/uv.lock","blobSha":"8bf6980137a09f5692c9e62798298a2cd9122a99","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/mucgpt/-/blob/46f1bd0b3a36f6d7b7bb0ea110665a5955a5e7a8/mucgpt-core-service/uv.lock","commitSha":"46f1bd0b3a36f6d7b7bb0ea110665a5955a5e7a8"},{"id":"component:127e332d31295197d407a5e4","repositoryId":"opencode:7202","repositorySlug":"opencode-7202","repositoryName":"MUCGPT","repositoryPathWithNamespace":"landeshauptstadt-muenchen/mucgpt","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.5.7","versionKey":"pypi:tornado@6.5.7","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"77989726989ea666c8557d105b2bf2c064daa319","sourceUrl":"https://gitlab.opencode.de/landeshauptstadt-muenchen/mucgpt/-/blob/46f1bd0b3a36f6d7b7bb0ea110665a5955a5e7a8/uv.lock","commitSha":"46f1bd0b3a36f6d7b7bb0ea110665a5955a5e7a8"},{"id":"component:81e1d700a9a12b3a5200a276","repositoryId":"opencode:4112","repositorySlug":"opencode-4112","repositoryName":"Objection management","repositoryPathWithNamespace":"uba-ki-lab/objection-management","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.4.2","versionKey":"pypi:tornado@6.4.2","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"8515db65670904208e99397a2d7878af759c74f3","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/objection-management/-/blob/5c1425bf9990cf12c5ae8ada47d249710703af18/uv.lock","commitSha":"5c1425bf9990cf12c5ae8ada47d249710703af18"},{"id":"component:88e1d813595963166665c683","repositoryId":"opencode:10775","repositorySlug":"opencode-10775","repositoryName":"Ressource Efficient Computer Vision","repositoryPathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.5.4","versionKey":"pypi:tornado@6.5.4","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"047f47304acd18a48770c101f5a8383cd19bb134","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/ressource-efficient-computer-vision/-/blob/9aa07461b879a6161b7e901ea4c2a382b8f1b4ae/uv.lock","commitSha":"9aa07461b879a6161b7e901ea4c2a382b8f1b4ae"},{"id":"component:fe3e87d6682474c2a27cc6b4","repositoryId":"opencode:10162","repositorySlug":"opencode-10162","repositoryName":"SmartPlanAI Anwendung","repositoryPathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.5.2","versionKey":"pypi:tornado@6.5.2","direct":null,"development":false,"sourceKind":"poetry-lock","filePath":"blp_streamlit_pipeline/src/ext/streamlit-draw-image-mask/poetry.lock","blobSha":"40fa29ec0b8e6e3bfbf4c2ff77526dd4038e0299","sourceUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung/-/blob/1d70807d48a8fae19711b10422c3417ab5d05d0f/blp_streamlit_pipeline/src/ext/streamlit-draw-image-mask/poetry.lock","commitSha":"1d70807d48a8fae19711b10422c3417ab5d05d0f"},{"id":"component:bfc165cd163f99483cdc3aa8","repositoryId":"opencode:10162","repositorySlug":"opencode-10162","repositoryName":"SmartPlanAI Anwendung","repositoryPathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.5.5","versionKey":"pypi:tornado@6.5.5","direct":null,"development":false,"sourceKind":"poetry-lock","filePath":"poetry.lock","blobSha":"6b17710ca48cf83827a909c320d60853c75d7960","sourceUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung/-/blob/1d70807d48a8fae19711b10422c3417ab5d05d0f/poetry.lock","commitSha":"1d70807d48a8fae19711b10422c3417ab5d05d0f"},{"id":"component:647ae8d2994ca9e39738a930","repositoryId":"opencode:5142","repositorySlug":"opencode-5142","repositoryName":"strahlenexposition","repositoryPathWithNamespace":"uba-ki-lab/strahlenexposition","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.4.2","versionKey":"pypi:tornado@6.4.2","direct":null,"development":null,"sourceKind":"sbom-json","filePath":"sbom.json","blobSha":"bce3149701e5462f1af80e9221c0e2967402d606","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/strahlenexposition/-/blob/1dd9cd8ca823a7998b729adce6957848cf241d54/sbom.json","commitSha":"1dd9cd8ca823a7998b729adce6957848cf241d54"},{"id":"component:96eb4b63e8d21246865d2b37","repositoryId":"opencode:7788","repositorySlug":"opencode-7788","repositoryName":"Workshop Green LLM Usage","repositoryPathWithNamespace":"uba-ki-lab/workshop-green-llm-usage","ecosystem":"pypi","name":"tornado","identity":"pypi:tornado","version":"6.5.2","versionKey":"pypi:tornado@6.5.2","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"bf2ad06a6324960d4a6a7a91340009e907848d0a","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/workshop-green-llm-usage/-/blob/d72ec94b58729e8b5e32caa9484867ec13add189/uv.lock","commitSha":"d72ec94b58729e8b5e32caa9484867ec13add189"}],"occurrenceCount":10},"related":{"repositories":[{"id":"opencode:7202","slug":"opencode-7202","name":"MUCGPT","pathWithNamespace":"landeshauptstadt-muenchen/mucgpt","versions":["6.5.7"],"evidenceCount":3},{"id":"opencode:10162","slug":"opencode-10162","name":"SmartPlanAI Anwendung","pathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung","versions":["6.5.2","6.5.5"],"evidenceCount":2},{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["6.5.1"],"evidenceCount":1},{"id":"opencode:4112","slug":"opencode-4112","name":"Objection management","pathWithNamespace":"uba-ki-lab/objection-management","versions":["6.4.2"],"evidenceCount":1},{"id":"opencode:10775","slug":"opencode-10775","name":"Ressource Efficient Computer Vision","pathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","versions":["6.5.4"],"evidenceCount":1},{"id":"opencode:5142","slug":"opencode-5142","name":"strahlenexposition","pathWithNamespace":"uba-ki-lab/strahlenexposition","versions":["6.4.2"],"evidenceCount":1},{"id":"opencode:7788","slug":"opencode-7788","name":"Workshop Green LLM Usage","pathWithNamespace":"uba-ki-lab/workshop-green-llm-usage","versions":["6.5.2"],"evidenceCount":1}],"vulnerabilities":[{"id":"GHSA-3x9g-8vmp-wqvf","slug":"ghsa-3x9g-8vmp-wqvf-6d03bf5f","dossier":false,"summary":"Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient","aliases":["CVE-2026-49853","PYSEC-2026-3387"],"sourceIds":["GHSA-3x9g-8vmp-wqvf","PYSEC-2026-3387"],"published":"2026-06-15T20:20:00Z","modified":"2026-07-13T16:42:55.378655356Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3x9g-8vmp-wqvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49853"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-78cv-mqj4-43f7","slug":"ghsa-78cv-mqj4-43f7-2021f695","dossier":false,"summary":"Tornado has incomplete validation of cookie attributes","aliases":["CVE-2026-35536","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287"],"sourceIds":["GHSA-78cv-mqj4-43f7","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287"],"published":"2026-03-11T22:17:00Z","modified":"2026-07-13T16:45:06.531920939Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/24a2d96ea115f663b223887deb0060f13974c104"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35536"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fqwm-6jpj-5wxc"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-7cx3-6m66-7c5m","slug":"ghsa-7cx3-6m66-7c5m-cde5125c","dossier":false,"summary":"Tornado vulnerable to excessive logging caused by malformed multipart form data","aliases":["CVE-2025-47287","PYSEC-2026-1974"],"sourceIds":["GHSA-7cx3-6m66-7c5m","PYSEC-2026-1974"],"published":"2025-05-16T14:12:40Z","modified":"2026-07-07T17:56:45.268719923Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47287"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7162f3"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00038.html"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7cx3-6m66-7c5m"}],"versionKeys":["pypi:tornado@6.4.2"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-cx3h-4qpv-8hc9","slug":"ghsa-cx3h-4qpv-8hc9-3078b6fa","dossier":false,"summary":"Tornado has out-of-bounds memory access via C extension","aliases":["CVE-2026-49854","PYSEC-2026-3388"],"sourceIds":["GHSA-cx3h-4qpv-8hc9","PYSEC-2026-3388"],"published":"2026-06-12T18:30:19Z","modified":"2026-07-13T16:43:34.663472817Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.6"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cx3h-4qpv-8hc9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49854"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-mgf9-4vpg-hj56","slug":"ghsa-mgf9-4vpg-hj56-00729355","dossier":false,"summary":"tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)","aliases":["CVE-2026-49855","PYSEC-2026-3389"],"sourceIds":["GHSA-mgf9-4vpg-hj56","PYSEC-2026-3389"],"published":"2026-06-15T20:19:28Z","modified":"2026-07-13T16:43:27.241564365Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mgf9-4vpg-hj56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49855"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-pw6j-qg29-8w7f","slug":"ghsa-pw6j-qg29-8w7f-fb4d7ed6","dossier":false,"summary":"Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse","aliases":[],"sourceIds":["GHSA-pw6j-qg29-8w7f"],"published":"2026-06-15T20:37:24Z","modified":"2026-06-16T22:59:25.768721886Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-qjxf-f2mg-c6mc","slug":"ghsa-qjxf-f2mg-c6mc-58d52008","dossier":false,"summary":"Tornado is vulnerable to DoS due to too many multipart parts","aliases":["CVE-2026-31958","PYSEC-2026-140"],"sourceIds":["GHSA-qjxf-f2mg-c6mc","PYSEC-2026-140"],"published":"2026-03-11T20:16:16.617Z","modified":"2026-06-08T20:00:14.385003861Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31958"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/119a195e290c43ad2d63a2cf012c29d43d6ed839"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2026-140.yaml"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4"],"packageCount":1,"repositoryCount":6},{"id":"PYSEC-2025-265","slug":"pysec-2025-265-33beac08","dossier":false,"summary":null,"aliases":["CVE-2025-67724","GHSA-pr2v-jx2c-wg9f"],"sourceIds":["PYSEC-2025-265"],"published":"2025-12-12T06:15:41.213Z","modified":"2026-07-13T07:15:44.068555841Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.3"},{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f"},{"type":"FIX","url":"https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-266","slug":"pysec-2025-266-c9802ae6","dossier":false,"summary":null,"aliases":["CVE-2025-67725","GHSA-c98p-7wgm-6p64"],"sourceIds":["PYSEC-2025-266"],"published":"2025-12-12T06:15:41.380Z","modified":"2026-07-13T07:15:44.064352714Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.3"},{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64"},{"type":"FIX","url":"https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-267","slug":"pysec-2025-267-ca9685ba","dossier":false,"summary":null,"aliases":["CVE-2025-67726","GHSA-jhmp-mqwm-3gq8"],"sourceIds":["PYSEC-2025-267"],"published":"2025-12-12T07:15:44.920Z","modified":"2026-07-13T07:15:45.375541292Z","checkedAt":"2026-07-20T14:37:29.537Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.3"},{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8"},{"type":"FIX","url":"https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2"],"packageCount":1,"repositoryCount":5}]}}