ci(pip-audit): audit on Python 3.13 instead of ignoring filelock CVEs #45

2026-10-28T21:18:22-04:00

jared commented

2026-10-28 21:18:22 -04:00

The pip-audit job started failing today on 11 newly published filelock 4.1.0 CVEs, all fixed in 4.2.1. filelock comes from pip-audit's own dependency (CacheControl[filecache]), not from the bot. The audit environment ran Python 3.10, which can't install filelock 4.2+, so the only option so far was to ignore each CVE by ID (six already were).

The audit now runs on standalone Python 3.13.2, the same minor version as the bot's runtime on LXC 151 (Debian trixie, 3.13.5). The fixed filelock installs, so the per-CVE ignores are removed. Only the pip CVE ignore stays.
discord-bridge/ is added to the gitleaks scan (see #44).

This unblocks #44.

🤖 Generated with Claude Code

https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

The pip-audit job started failing today on 11 newly published `filelock` 4.1.0 CVEs, all fixed in 4.2.1. `filelock` comes from pip-audit's own dependency (CacheControl[filecache]), not from the bot. The audit environment ran Python 3.10, which can't install filelock 4.2+, so the only option so far was to ignore each CVE by ID (six already were). - The audit now runs on standalone Python 3.13.2, the same minor version as the bot's runtime on LXC 151 (Debian trixie, 3.13.5). The fixed filelock installs, so the per-CVE ignores are removed. Only the pip CVE ignore stays. - `discord-bridge/` is added to the gitleaks scan (see #44). This unblocks #44. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared added 1 commit 2026-10-28 21:18:22 -04:00

ci(pip-audit): audit on Python 3.13 instead of ignoring filelock CVEs

Lint / JS (eslint) (push) Successful in 8s

Details

Lint / Shell (shellcheck) (push) Successful in 10s

Details

Lint / No secrets in webhook configs (push) Successful in 5s

Details

Lint / Landing page is rendered (matrix (push) Successful in 4s

Details

Lint / Python (ruff) (push) Successful in 11s

Details

Lint / Secret scan (gitleaks) (push) Successful in 11s

Details

Lint / Shell (shellcheck) (pull_request) Successful in 15s

Details

Lint / JS (eslint) (pull_request) Successful in 11s

Details

Lint / No secrets in webhook configs (pull_request) Successful in 8s

Details

Lint / Landing page is rendered (matrix (pull_request) Successful in 8s

Details

Lint / Python (ruff) (pull_request) Successful in 8s

Details

Lint / Python deps (pip-audit) (push) Successful in 1m33s

Details

Lint / Secret scan (gitleaks) (pull_request) Successful in 10s

Details

Lint / Python deps (pip-audit) (pull_request) Successful in 1m0s

Details

246774e3eb

The audit env ran Python 3.10, which can't install filelock 4.2+, so
every new filelock CVE in pip-audit's own CacheControl dependency broke
the job and had to be ignored by ID (11 more landed today). Audit on
3.13, which matches the bot's runtime on LXC 151 (Debian trixie), so
the fixed filelock installs and the per-CVE ignores can go. Also scan
discord-bridge/ for secrets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

jared scheduled this pull request to auto merge when all checks succeed 2026-10-28 21:18:27 -04:00

jared merged commit e16ce42785 into main

2026-10-28 21:21:38 -04:00

jared deleted branch ci/pip-audit-py313

2026-10-28 21:21:38 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/matrix#45