Public release evidence

kaelah971/limen-demoPR #1

View source pull request

Receipt IDLM-REC-B1306724D0B84B6EBDDF7E36

HOLD

This release is held.

This release matches a blocking dependency policy condition.

Next action

Update the dependency to a version that clears all blocking findings under the current policy.

Recorded reason

An affected dependency matches the policy's blocked scope and severity.

Decision mix3 PASS / 1 HOLD / 1 REVIEW

Run completed2026-09-02T16:20:58+00:00

Evidence path

REPOSITORYContext and exposure

TELEGRAPHRouted CVE signal

POLICYDeclared release rule

DECISIONHOLD

GitHub / Dependency Review

Repository evidence

Repository-specific package context and exposure facts.

Package: lodash
Installed: 4.17.20
Relationship: unknown
Scope: runtime
Manifest: package-lock.json
CVE: CVE-2021-23337
Affected range: < 4.17.21
First patched: 4.17.21
Severity: HIGH
CVSS: Not available
Exposure: affected
Source: github-dependency-review+global-advisory

Telegraph / CVE_LOOKUP

Routed CVE evidence

External evidence and operational provenance, kept separate from repository facts.

CVE: CVE-2021-23337
Severity: HIGH
CVSS: Not available
Affected: Not available
Fixed: Not available
Miner: PREFLIGHT Infrastructure Signals
Intent: CVE_LOOKUP
Cost: $0.01
Latency: 1043 ms
Network: Not available
Payment: Not available
Timestamp: Not available
Requested: Not available
Received: Not available

CVE-2021-23337SUCCESS$0.01 / 1043 ms

Intent

CVE_LOOKUP

Miner

PREFLIGHT Infrastructure Signals

Cost

$0.01

Latency

1043 ms

Network

Not available

Payment

Not available

Requested

Not available

Received

Not available

CVE-2026-4800SUCCESS$0.01 / 561 ms

Intent

CVE_LOOKUP

Miner

PREFLIGHT Infrastructure Signals

Cost

$0.01

Latency

561 ms

Network

Not available

Payment

Not available

Requested

Not available

Received

Not available

CVE-2020-28500SUCCESS$0.01 / 321 ms

Intent

CVE_LOOKUP

Miner

PREFLIGHT Infrastructure Signals

Cost

$0.01

Latency

321 ms

Network

Not available

Payment

Not available

Requested

Not available

Received

Not available

CVE-2025-13465SUCCESS$0.01 / 557 ms

Intent

CVE_LOOKUP

Miner

PREFLIGHT Infrastructure Signals

Cost

$0.01

Latency

557 ms

Network

Not available

Payment

Not available

Requested

Not available

Received

Not available

CVE-2026-2950SUCCESS$0.01 / 328 ms

Intent

CVE_LOOKUP

Miner

PREFLIGHT Infrastructure Signals

Cost

$0.01

Latency

328 ms

Network

Not available

Payment

Not available

Requested

Not available

Received

Not available

Limen policy

Policy evaluation

Relevant checks from policy version LP-fde4ac5cdba2.

No decision checks recorded

The public receipt contains no additional policy check rows for this decision.

Other evaluated CVEs

The rest of this release

Additional decisions remain available without competing with the primary outcome.

REVIEWCVE-2026-4800

Repository and Telegraph severity values conflict; human review is required.

PASSCVE-2020-28500

Repository evidence does not meet a blocking policy condition.

PASSCVE-2025-13465

Repository evidence does not meet a blocking policy condition.

PASSCVE-2026-2950

Repository evidence does not meet a blocking policy condition.

Receipt / provenance

Share the decision without the private ledger.

demobackfill

Receipt ID

LM-REC-B1306724D0B84B6EBDDF7E36

Schema

limen.receipt.v1

Snapshot SHA-256

41cbf844690a2a15bf6d7d0fdc6bfd8bf8ae08cd684d735eb611d069f3ffebdf

Policy version

LP-fde4ac5cdba2

Published

2026-09-03T14:33:01.487214+00:00

This receipt is a public projection of Limen's durable evidence record. Private ledger data and credentials are not exposed here.