From 9f6ce7dc634cb60716958315890f74a7c0616d3d Mon Sep 17 00:00:00 2001 From: catborise Date: Sat, 24 Oct 2026 09:43:23 +0300 Subject: [PATCH] ci: the audit checks the packages installations get, not the CI tools pip-audit audited the whole CI environment, so on Python 3.10 it failed on filelock 4.1.0, a dependency of pip-audit itself: six CVEs published on 2026-10-23 are fixed only in filelock 4.2.1, which needs Python 3.11. No installation gets filelock. The step now audits conf/requirements.txt and conf/requirements-ldap.txt, resolved for the leg's Python, which is what the audit is for. --- .github/workflows/test.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e8ab30ae..ffe50b72 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -120,8 +120,10 @@ jobs: - name: Deployment Checks run: python manage.py check --deploy --fail-level ERROR - - name: Audit Installed Packages - run: pip-audit + # What installations get, resolved for this Python; not the CI tools + # (their fixes can need a newer Python than the leg's, as filelock's did) + - name: Audit Shipped Packages + run: pip-audit -r conf/requirements.txt -r conf/requirements-ldap.txt docker: name: Docker Image