Security Fix Automation

Ghaf uses flakevuln to scan configured Nix flake outputs for known vulnerabilities. It compares the pinned dependencies with newer nixpkgs revisions to highlight potential fixes available through dependency updates or backports.

Daily results are available in the Ghaf flakevuln workflow runs, with a summary and downloadable report artifacts for manual review. See the flakevuln overview for details of the scans, comparisons, and reports.