Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Verify hashes for the Serena package installation

Open
  • Is something wrong?
#14,993 0 comments 1 reaction 2 assignees View on GitHub

Maintainers usually reply within 1 day

@lpcox is already working on this.

Since Oct 16, 2026.

  • #14998 by @copilot-swe-agent — closed without merging

Assessment

This issue has not been assessed yet.

Description

Code scanning finding

Finding

The image installs Serena directly from an unpinned GitHub branch and falls back to an unhashed PyPI package:

RUN pip install --no-cache-dir git+https://github.com/oraios/serena.git || \
    (echo "GitHub installation failed, trying PyPI..." && \
     pip install --no-cache-dir serena-agent)

Neither source is integrity-verified. The Git dependency is also not pinned to an immutable commit, and the fallback can silently produce materially different artifacts depending on transient availability.

Recommended remediation

Use a locked dependency artifact with hashes and install using pip --require-hashes, or otherwise pin the Git dependency to a reviewed commit and verify the downloaded artifact. Reconsider the automatic fallback so a failed primary install does not silently change the dependency source.

Acceptance criteria

  • Serena and its transitive dependencies are pinned to reviewed immutable versions.
  • Package artifacts are verified with hashes or an equivalent integrity mechanism.
  • Installation fails explicitly rather than silently switching to an unverified source.
  • The Serena container still builds successfully.
  • Code scanning alert #6 is resolved, or dismissed with documented justification.
Dominant language
Go
Stars
181
Forks
53
Avg merge
7h 8m
Merged PRs (30d)
215

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw-mcpg

All issues in github/gh-aw-mcpg

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.