Scorecard Tool, via OSV, Reports These CVEs In This Project

[jspeed-meyers]

score is 4: 6 existing vulnerabilities detected:
Warn: Project is vulnerable to: CVE-2022-48174
Warn: Project is vulnerable to: CVE-2023-42363
Warn: Project is vulnerable to: CVE-2023-42364
Warn: Project is vulnerable to: CVE-2023-42365
Warn: Project is vulnerable to: CVE-2023-42366
Warn: Project is vulnerable to: GHSA-269g-pwp5-87pp
Click Remediation section below to solve this issue

What's going on? I need to investigate. Thoughts welcome.

[goneall]

I haven't used the OSV plugin myself - for the Java repos, I've used a dependency check plugin for Maven before each release.

About half the time, it is a false positive which I can configure to ignore. In other cases, it's just updating dependencies - but the dependencies in this project are pretty current.

[bact]

https://github.com/spdx/ntia-conformance-checker/blob/main/.github/workflows/python-publish.yml use v3 of actions/checkout which may use an outdated version of npm.