python-sqlite-vec 0.1.9-2
A vector search SQLite extension.
config.json file.
/v1/packages/python-sqlite-vec/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| a190107ec569head | verified | 2026-11-05 16:05 | 8 |
| 8ad44b6ad7ac | verified | 2026-11-05 16:00 | 5 |
Head findings
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
staging=$(mktemp -d)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
printf '%s,sha256=%s,%s\n' $f $(sha256sum $staging/$f | cut -d' ' -f1 | tr 'a-f' 'A-F' | basenc --base16 -d | basenc --base64url -w0 | tr -d '=') $(stat -c%s $staging/$f) >> $staging/$distinfo/RECORD
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
outdir=$(realpath $outdir)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
DATE=$(date -r VERSION +'%FT%TZ%z') \
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
SOURCE=$(git log -n 1 --pretty=format:%H -- VERSION)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
VERSION_MAJOR=$(echo $pkgver | cut -d. -f1)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
VERSION_MINOR=$(echo $pkgver | cut -d. -f2)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
VERSION_PATCH=$(echo $pkgver | cut -d. -f3)
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.