From 7fc2fa04d7d88a1cdf0d290ddd2de3815a7d52a5 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Thu, 15 Oct 2026 14:56:35 +0200 Subject: build: audit the shipped Python dependencies with pip-audit No lock file pins the dependencies, so each build installs the newest releases and what ships is only known once it has. packaging/audit_deps.py runs pip-audit then: build-common.sh on the venv before stripping it, build-node-runtime.ps1 on the environment before PyInstaller freezes it. A known vulnerability stops the build, unless its id is listed in packaging/pip-audit-ignore.txt with why it does not apply. No network only skips the audit with a warning, as does a pip-audit that cannot be installed or writes no report. pip-audit runs from a venv of its own, never from the one that ships. Our packages are not audited (not on PyPI), nor pip, setuptools and wheel, which do not ship. Checked with the real build-common.sh (79 packages, none known), with PyJWT 2.14 (the build stops on its two advisories, and goes on once they are listed) and offline (a warning, the build goes on). The PowerShell step was not run here. Co-Authored-By: Claude Opus 5.5 --- packaging/pip-audit-ignore.txt | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 packaging/pip-audit-ignore.txt (limited to 'packaging/pip-audit-ignore.txt') diff --git a/packaging/pip-audit-ignore.txt b/packaging/pip-audit-ignore.txt new file mode 100644 index 0000000..8aec984 --- /dev/null +++ b/packaging/pip-audit-ignore.txt @@ -0,0 +1,6 @@ +# Vulnerabilities packaging/audit_deps.py lets through, one per line: +# +# # why it does not apply to MeshBay, and when to look again +# +# An id is what pip-audit prints (PYSEC-…, GHSA-…, CVE-…). Remove a line once +# the fixed version ships. -- cgit v1.2.3