From dcb38618a7e9eb192999358d9895094be8579303 Mon Sep 17 00:00:00 2001 From: Jared Vititoe Date: Tue, 21 Apr 2026 14:06:01 -0400 Subject: [PATCH] ci: upgrade pip+setuptools before audit to clear bundled CVEs The python-build-standalone tarball ships pip 24.1.2 and setuptools 70.3.0 which have known CVEs. Upgrade them first so --local audit only sees current, patched versions. Co-Authored-By: Claude Sonnet 4.6 --- .gitea/workflows/lint.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/lint.yml b/.gitea/workflows/lint.yml index 5796c62..ebcc271 100644 --- a/.gitea/workflows/lint.yml +++ b/.gitea/workflows/lint.yml @@ -60,9 +60,11 @@ jobs: # Debian Bullseye only ships Python 3.9; use a prebuilt standalone binary curl -sSL "https://github.com/indygreg/python-build-standalone/releases/download/20241002/cpython-3.10.15+20241002-x86_64-unknown-linux-gnu-install_only.tar.gz" \ | tar -xz -C /opt - # Install pip-audit + the bot's requirements into the same env. + # Upgrade pip+setuptools first (standalone build ships old versions with CVEs), + # then install pip-audit + the bot's requirements into the same env. # Using --local avoids pip-audit creating an internal venv (which fails # with ensurepip exit 127 on this standalone build). + /opt/python/bin/pip install --upgrade pip setuptools /opt/python/bin/pip install pip-audit -r matrixbot/requirements.txt - name: Audit matrixbot dependencies