Builder safety

Builder safety is the record of security warnings for the code that builders use. A security advisory is a public warning about a hole in a piece of software. GitHub keeps the list and rates each one. The Reef records every day's changes on Flare, so anyone can check what was known and when.

Records

1 record

Since October 30, 2026: 114 new warnings recorded. GitHub rated 24 of them critical.

The ratings are GitHub's own. The Reef adds no score.

November 9, 2026: 45 new, 23 changed, 0 withdrawn. GitHub rated 6 of the new ones critical and 20 high.

Named: fastapi-code-generator, github[.]com/pocket-id/pocket-id/backend, gpustack, github[.]com/kubeflow/pipelines, loggingredactor and 47 more

Permanent record

November 7, 2026: 0 new, 2 changed, 0 withdrawn. GitHub rated 0 of the new ones critical and 0 high.

Named: misp-modules, paramiko

Permanent record

November 6, 2026: 18 new, 6 changed, 0 withdrawn. GitHub rated 6 of the new ones critical and 4 high.

Named: github[.]com/canonical/lxd, github[.]com/osac-project/osac-operator, GeoNode, Magick[.]NET-Q16-AnyCPU, org[.]eclipse[.]hawkbit:hawkbit-ddi-resource and 23 more

Permanent record

November 5, 2026: 10 new, 30 changed, 0 withdrawn. GitHub rated 3 of the new ones critical and 4 high.

Named: urwid, flowise, github[.]com/chainguard-dev/kaniko, org[.]apache[.]activemq:apache-activemq, org[.]apache[.]activemq:activemq-all and 23 more

Permanent record

November 4, 2026: 17 new, 46 changed, 0 withdrawn. GitHub rated 1 of the new ones critical and 9 high.

Named: org[.]apache[.]tomcat[.]embed:tomcat-embed-core, org[.]apache[.]tomcat:tomcat, org[.]apache[.]tomcat:tomcat-util-scan, org[.]apache[.]activemq:activemq-broker, org[.]apache[.]activemq:apache-activemq and 62 more

Permanent record

November 3, 2026: 22 new, 29 changed, 1 withdrawn. GitHub rated 8 of the new ones critical and 9 high.

Named: flowise, enspirit/elo, prefect, org[.]apache[.]iotdb:iotdb-server, Metalama[.]Framework and 132 more

Permanent record

November 2, 2026: 2 new, 16 changed, 0 withdrawn. GitHub rated 0 of the new ones critical and 1 high.

Named: sd-jwt/decode, sd-jwt/core, bytebase/dbhub, facturascripts/facturascripts, parse-server and 11 more

Permanent record