`pip scan-packages :: hf-stack` now fails on PRs whose closure resolves
unsloth-zoo 2026.10.11, for example #16258:
```
Summary: 5 CRITICAL, 7 HIGH, 172 MEDIUM
12 of the 184 finding(s) above are at a site already reviewed in scripts/scan_packages_baseline.json. What differs from the reviewed entry:
HIGH unsloth-zoo unsloth_zoo/compiler.py same matched code, file digest outside the pin
CRITICAL unsloth-zoo unsloth_zoo/device_type.py same matched code, file digest outside the pin
...
```
All twelve are the same kind: the scanner's matched code is
byte-identical to a reviewed entry (the same `evidence_hash`), and only
the pinned `file_sha256` moved because other lines in the file changed
in the release.
| File | Check | Reviewed `evidence_hash` matches |
|---|---|---|
| `unsloth_zoo/device_type.py` | env + network | yes |
| `unsloth_zoo/llama_cpp.py` | env + network | yes |
| `unsloth_zoo/triton_kernels_compat.py` | downloads and executes remote
code | yes |
| `unsloth_zoo/vision_utils.py` | env + network | yes |
| `unsloth_zoo/vision_utils.py` | cloud metadata + network | yes |
| `unsloth_zoo/compiler.py` | obfuscation + exec/eval | yes |
| `unsloth_zoo/vllm_gdn_replayssm.py` | obfuscation + exec/eval | yes |
| `unsloth_zoo/vllm_utils.py` | obfuscation + exec/eval | yes |
| `unsloth_zoo/mlx/decision.py` | obfuscation + exec/eval | yes |
| `unsloth_zoo/mlx/loader.py` | obfuscation + exec/eval | yes |
| `unsloth_zoo/mlx/speculative.py` | obfuscation + exec/eval | yes |
| `unsloth_zoo/temporary_patches/moe_utils.py` | obfuscation + exec/eval
| yes |
## Change
As in #16114, each new entry sits next to the reviewed one it matches,
pinned at the 2026.10.11 file digest. Nothing is removed, so shards that
still resolve older zoo releases are unaffected. I did not regenerate
the whole file with `--write-baseline`, since a single-package scan
would drop every other package's entries. The diff is 108 added lines
and no removed ones.
## Verification
- `scripts/scan_packages.py unsloth-zoo==2026.10.11` on main gives `5
CRITICAL, 7 HIGH` with exit 1, matching the CI hf-stack run. On this
branch it exits 0 (`24 finding(s) suppressed by baseline`, 13 MEDIUM
left).
- The tests that read the scanner or its baseline, under
`tests/security` and the others that import it: 638 passed.
1341718c2c