From d36c782e56f44b0ef945cdc928ff1c5522142556 Mon Sep 17 00:00:00 2001 From: Lotus CI Date: Sat, 24 Oct 2026 17:35:45 -0400 Subject: [PATCH] ci(pip-audit): ignore filelock CVEs in pip-audit's own dependency pip-audit --local scans the whole audit env, which includes pip-audit's own CacheControl[filecache] -> filelock 4.1.0. Six new CVEs (fixed in 4.2.1) started failing every run; 4.2+ requires Python 3.11 and the audit env is 3.10. The bot does not use filelock. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5 --- .gitea/workflows/lint.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index d5d24b3..666bee6 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -94,8 +94,16 @@ jobs: - name: Audit matrixbot dependencies # --local scans the env without spawning a venv (required for standalone Python) - # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly - run: /opt/python/bin/pip-audit --local --ignore-vuln CVE-2026-3219 + # CVE-2026-3219 is in pip itself, not our code — ignore it explicitly. + # The filelock CVEs (fixed in 4.2.1) are in pip-audit's own dependency + # (CacheControl[filecache]); the bot doesn't use filelock, and 4.2+ + # needs Python 3.11, which this 3.10 audit env can't install. + run: >- + /opt/python/bin/pip-audit --local + --ignore-vuln CVE-2026-3219 + --ignore-vuln CVE-2026-112906 --ignore-vuln CVE-2026-112907 + --ignore-vuln CVE-2026-112913 --ignore-vuln CVE-2026-112914 + --ignore-vuln CVE-2026-112937 --ignore-vuln CVE-2026-112940 secret-scan: name: Secret scan (gitleaks)