requirements.txt and api/requirements.txt use >= ranges. The v0.9.0 pip-audit run came back clean, but pip-audit -r resolves those ranges to the latest versions — so the clean result describes a fresh install, not necessarily what is running on a brain provisioned months ago (which may hold older, vulnerable transitive versions).
Proposal:
- Add a lockfile (pip-tools
requirements.txt compiled from a .in, or uv/Poetry) with hashes.
- Run
pip-audit against the locked versions in CI so the audit reflects what actually ships.
- Document a periodic dependency-refresh cadence.
Build/supply-chain hygiene; not a known active vuln.
requirements.txtandapi/requirements.txtuse>=ranges. The v0.9.0pip-auditrun came back clean, butpip-audit -rresolves those ranges to the latest versions — so the clean result describes a fresh install, not necessarily what is running on a brain provisioned months ago (which may hold older, vulnerable transitive versions).Proposal:
requirements.txtcompiled from a.in, or uv/Poetry) with hashes.pip-auditagainst the locked versions in CI so the audit reflects what actually ships.Build/supply-chain hygiene; not a known active vuln.