cryptography, python-multipart, starlette, vcrpy, joserfc and mcp are all transitive with no floor in pyproject.toml. PR #119 fixed their CVEs in uv.lock only, so nothing structurally stops a future uv lock --upgrade or dependabot re-resolution from silently selecting a vulnerable version again. The security job's pip-audit step is currently the only thing holding the line. Either add floors to pyproject.toml for the six packages, or add a comment there recording the deliberate decision to rely on the CI gate alone.
From PR #119 review.
cryptography, python-multipart, starlette, vcrpy, joserfc and mcp are all transitive with no floor in pyproject.toml. PR #119 fixed their CVEs in uv.lock only, so nothing structurally stops a future
uv lock --upgradeor dependabot re-resolution from silently selecting a vulnerable version again. The security job's pip-audit step is currently the only thing holding the line. Either add floors to pyproject.toml for the six packages, or add a comment there recording the deliberate decision to rely on the CI gate alone.From PR #119 review.