From 4dc5ebfac7c4ed1d567c901ed18a55d3998cc9eb Mon Sep 17 00:00:00 2001 From: Jens Troeger Date: Sun, 26 Oct 2025 17:31:48 +1000 Subject: [PATCH] fix(ci): undo temporary ignore of GHSA-4xh5-x5gv-qwph (CVE-2025-8869) because the latest pip v25.3 addressed the issue Refs: 1c4e34a2c74d86bdfb410fe4376a006618ba8ba2 --- Makefile | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/Makefile b/Makefile index 6798807d..b5a71800 100644 --- a/Makefile +++ b/Makefile @@ -141,14 +141,13 @@ requirements.txt: pyproject.toml # Audit the currently installed packages. Skip packages that are installed in # editable mode (like the one in development here) because they may not have # a PyPI entry; also print out CVE description and potential fixes if audit -# found an issue. Note that we temporarily ignore GHSA-4xh5-x5gv-qwph until the -# issue is resolved: https://github.com/pypa/pip/issues/13607 +# found an issue. .PHONY: audit audit: if ! $$(python -c "import pip_audit" &> /dev/null); then \ echo "No package pip_audit installed, upgrade your environment!" && exit 1; \ fi; - python -m pip_audit --skip-editable --desc on --fix --dry-run --ignore-vuln GHSA-4xh5-x5gv-qwph + python -m pip_audit --skip-editable --desc on --fix --dry-run # Run some or all checks over the package code base. .PHONY: check check-code check-bandit check-flake8 check-lint check-mypy check-actionlint