LotusGuild/matrix

ci(pip-audit): audit on Python 3.13 instead of ignoring filelock CVEs #45

Merged

jared merged 1 commits from ci/pip-audit-py313 into main

2026-10-28 21:21:38 -04:00

Author	SHA1	Message	Date
Lotus CIandClaude Opus 5.5	246774e3eb	ci(pip-audit): audit on Python 3.13 instead of ignoring filelock CVEs Lint / JS (eslint) (push) Successful in 8s Details Lint / Shell (shellcheck) (push) Successful in 10s Details Lint / No secrets in webhook configs (push) Successful in 5s Details Lint / Landing page is rendered (matrix (push) Successful in 4s Details Lint / Python (ruff) (push) Successful in 11s Details Lint / Secret scan (gitleaks) (push) Successful in 11s Details Lint / Shell (shellcheck) (pull_request) Successful in 15s Details Lint / JS (eslint) (pull_request) Successful in 11s Details Lint / No secrets in webhook configs (pull_request) Successful in 8s Details Lint / Landing page is rendered (matrix (pull_request) Successful in 8s Details Lint / Python (ruff) (pull_request) Successful in 8s Details Lint / Python deps (pip-audit) (push) Successful in 1m33s Details Lint / Secret scan (gitleaks) (pull_request) Successful in 10s Details Lint / Python deps (pip-audit) (pull_request) Successful in 1m0s Details The audit env ran Python 3.10, which can't install filelock 4.2+, so every new filelock CVE in pip-audit's own CacheControl dependency broke the job and had to be ignored by ID (11 more landed today). Audit on 3.13, which matches the bot's runtime on LXC 151 (Debian trixie), so the fixed filelock installs and the per-CVE ignores can go. Also scan discord-bridge/ for secrets. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5	2026-10-28 21:18:13 -04:00