iqsh/collaboration-online-board/aiThis dossier retains 43 exact component occurrences from 2 published evidence files at one immutable repository commit.
Published dependency evidence does not prove deployment, productive use, procurement or runtime reachability.
project ID + commit SHA + exact evidence pathEvery file remains tied to the observed commit. A parse error stays visible and never becomes a zero.
sha256:e053bc3719cac7ca6a6b278c6593b5be1eef3090462cdd7398ae6d6ac3f21457pypi:openai1.14.2 · 1.91.0pypi:tiktoken0.7.0pypi:pillow10.3.015 OSV records returnedpypi:urllib32.2.27 OSV records returnedpypi:werkzeug3.0.16 OSV records returnedpypi:flask-cors4.0.05 OSV records returnedpypi:jinja23.1.34 OSV records returnedpypi:requests2.32.33 OSV records returnedpypi:setuptools69.2.03 OSV records returnedpypi:certifi2024.6.21 OSV record returnedpypi:click8.1.71 OSV record returnedpypi:flask3.0.21 OSV record returnedpypi:h110.14.01 OSV record returnedpypi:idna3.71 OSV record returnedpypi:pytest7.2.21 OSV record returnedpypi:python-dotenv1.0.11 OSV record returnedpypi:tqdm4.66.21 OSV record returnedpypi:wheel0.43.01 OSV record returnedpypi:annotated-types0.6.0pypi:anyio4.3.0pypi:attrs23.2.0pypi:blinker1.7.0pypi:charset-normalizer3.3.2pypi:coverage7.2.2pypi:distro1.9.0pypi:flask-sqlalchemy3.1.1pypi:greenlet3.0.3pypi:httpcore1.0.4pypi:httpx0.27.0pypi:iniconfig2.0.0pypi:itsdangerous2.1.2pypi:markupsafe2.1.5pypi:packaging24.1pypi:pluggy1.5.0pypi:psycopg2-binary2.9.9pypi:pydantic2.6.4pypi:pydantic-core2.16.3pypi:regex2024.5.15pypi:sniffio1.3.1pypi:sqlalchemy2.0.29pypi:typing-extensions4.10.0Certifi removes GLOBALTRUST root certificate
10 Jun 2026Werkzeug safe_join() allows Windows special device names
13 Jul 2026Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain
07 Jul 2026urllib3 streaming API improperly handles highly compressed data
07 Jul 2026Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
07 Jul 2026Flask-CORS vulnerable to Improper Handling of Case Sensitivity
07 Jul 2026urllib3 does not control redirects in browsers and Node.js
07 Jul 2026setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write
11 May 2026Pillow has a heap buffer overflow with nested list coordinates
13 Jul 2026Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix
08 Jul 2026Flask session does not add `Vary: Cookie` header when accessed in some ways
13 Jul 2026pytest has vulnerable tmpdir handling
07 Jul 2026Flask-CORS improper regex path matching vulnerability
07 Jul 2026flask-cors vulnerable to log injection when the log level is set to debug
10 Jun 2026Werkzeug safe_join() allows Windows special device names with compound extensions
07 Jul 2026Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack
07 Jul 2026Flask-CORS allows for inconsistent CORS matching
07 Jul 2026Requests vulnerable to .netrc credentials leak via malicious URLs
07 Jul 2026Requests `Session` object does not verify requests after making first request with verify=False
07 Jul 2026Pillow affected by out-of-bounds write when loading PSD images
13 Jul 2026Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
07 Jul 2026setuptools vulnerable to Command Injection via package URL
07 Jul 2026Werkzeug safe_join not safe on Windows
07 Jul 2026tqdm CLI arguments injection attack
07 Jul 2026Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
13 Jul 2026urllib3 allows an unbounded number of links in the decompression chain
07 Jul 2026Jinja has a sandbox breakout through malicious filenames
07 Jul 2026Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
07 Jul 2026Werkzeug safe_join() allows Windows special device names
07 Jul 2026Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default
09 Jul 2026urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
08 Jun 2026python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
13 Jul 2026urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
07 Jul 2026Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)
13 Jul 2026Jinja has a sandbox breakout through indirect reference to format method
07 Jul 2026Werkzeug possible resource exhaustion when parsing file data in forms
13 Jul 2026urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
20 May 2026Pillow has a PDF Parsing Trailer Infinite Loop (DoS)
13 Jul 2026h11 accepts some malformed Chunked-Encoding bodies
01 Jul 2026FITS GZIP decompression bomb in Pillow
13 Jul 2026Pillow has an integer overflow when processing fonts
09 Jun 2026Pillow vulnerability can cause write buffer overflow on BCn encoding
04 Feb 2026Not reported
13 Jul 2026Not reported
13 Jul 2026Not reported
13 Jul 2026Not reported
13 Jul 2026Not reported
13 Jul 2026Not reported
13 Jul 2026The collector reads bounded lockfiles, SBOMs and exact double-equals pins at one immutable commit. Version ranges are never resolved by assumption.
Retrieval, parsing, matching and publishing use no generative AI model.i6eal (2026): AI — exact AI dependency evidence dossier, data state 19 Jul 2026. https://i6eal.de/en/tools/ki-abhaengigkeitsatlas/repository/opencode-3608/
We build source-backed data products with stable identities, reproducible joins and boundaries that remain visible.
These tools complement the current result.