False positive SQLAlchemy 2.1.0b2 vulnerability

[54ny7]

Describe the bug
I installed SQLAlchemy 2.1.0b2, but I get critical warning to upgrade to ">= 1.2.19".

To Reproduce

1. I created an empty project, created the pyproject.toml, and install modules.
2. Run pyscan.
3. I get warn.

Expected behavior
SQLAlchemy should be not vulnerable.

I hope this is a useful command:

(.venv) PS C:\git\greenfield> python -m pip show sqlalchemy pyscan-rs ; pyscan       
Name: SQLAlchemy
Version: 2.1.0b2
Summary: Database Abstraction Library
Home-page: https://www.sqlalchemy.org
Author: 
Author-email: Mike Bayer <mike_mp@zzzcomputing.com>
License-Expression: MIT
Location: C:\git\greenfield\.venv\Lib\site-packages
Requires: typing-extensions
Required-by: 
---
Name: pyscan-rs
Version: 2.1.3
Summary: 
Home-page: https://github.com/ohaswin/pyscan
Author: 
Author-email: 
License: 
Location: C:\git\greenfield\.venv\Lib\site-packages
Requires: 
Required-by: 
  pyscan v2.1.3 │ by Aswin (https://github.com/ohaswin)
  ─────────────────────────────────────────────────────
  ℹ  Source: pyproject.toml
  ℹ  Found 5 dependencies
An error occurred while retrieving 'pip-audit' version info from pip.
pip error: Package not found in pip
An error occurred while retrieving 'pyyaml' version info from pip.
pip error: Package not found in pip
An error occurred while retrieving 'sqlalchemy' version info from pip.
pip error: Package not found in pip
  ✘ Scan complete — 1 vulnerability found.                                                                                                                                          
┌──────────┬────────────┬───────────┬────────────┬─────────────────────┐
│ Severity ┆ Dependency ┆ Installed ┆ Fixed In   ┆ Vuln ID             │
╞══════════╪════════════╪═══════════╪════════════╪═════════════════════╡
│ ✘ CRIT   ┆ sqlalchemy ┆ 2.1.0-0b2 ┆ >= 1.2.19  ┆ GHSA-38fc-9xqv-7f7q │
├╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ ✘ CRIT   ┆   ↳        ┆           ┆ >= 1.3.0b3 ┆ GHSA-887w-45rq-vxgf │
├╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ ✘ CRIT   ┆   ↳        ┆           ┆ >= 0.7.0b4 ┆ GHSA-hfg2-wf6j-x53p │
├╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ ℹ UNKN   ┆   ↳        ┆           ┆ >= 0.7.0   ┆ PYSEC-2012-9        │
├╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ ℹ UNKN   ┆   ↳        ┆           ┆ >= 1.3.0b3 ┆ PYSEC-2019-123      │
├╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌┼╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌╌┤
│ ℹ UNKN   ┆   ↳        ┆           ┆ >= 1.2.18  ┆ PYSEC-2019-124      │
└──────────┴────────────┴───────────┴────────────┴─────────────────────┘

  ✔ 4 safe dependencies not shown

pyscan::vulnerability

  x GHSA-38fc-9xqv-7f7q: SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
   ,-[C:\git\greenfield\pyproject.toml:4:6]
 3 |     "pip>=26.1.2", # installed 26.1.2
 4 |     "sqlalchemy>=2.0.41", # installed 2.1.0b2
   :      ^^^^^^^^^^^^^^^^^^^^|^^^^^^^^^^^^^^^^^^^^
   :                          `-- vulnerable dependency declared here
 5 |     "pyyaml>=5.1", # installed 6.0.3
 6 | ]
   `----
  help: Update 'sqlalchemy' to >= 1.2.19

pyscan::vulnerability

  x GHSA-887w-45rq-vxgf: SQLAlchemy before 1.3.0b3 allows SQL Injection via the order_by parameter. The fix (commit 30307c4) was applied only to the main branch and was never...
   ,-[C:\git\greenfield\pyproject.toml:4:6]
 3 |     "pip>=26.1.2", # installed 26.1.2
 4 |     "sqlalchemy>=2.0.41", # installed 2.1.0b2
   :      ^^^^^^^^^^^^^^^^^^^^|^^^^^^^^^^^^^^^^^^^^
   :                          `-- vulnerable dependency declared here
 5 |     "pyyaml>=5.1", # installed 6.0.3
 6 | ]
   `----
  help: Update 'sqlalchemy' to >= 1.3.0b3

pyscan::vulnerability

  x GHSA-hfg2-wf6j-x53p: Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands...
   ,-[C:\git\greenfield\pyproject.toml:4:6]
 3 |     "pip>=26.1.2", # installed 26.1.2
 4 |     "sqlalchemy>=2.0.41", # installed 2.1.0b2
   :      ^^^^^^^^^^^^^^^^^^^^|^^^^^^^^^^^^^^^^^^^^
   :                          `-- vulnerable dependency declared here
 5 |     "pyyaml>=5.1", # installed 6.0.3
 6 | ]
   `----
  help: Update 'sqlalchemy' to >= 0.7.0b4

pyscan::vulnerability

  x PYSEC-2012-9: Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands...
   ,-[C:\git\greenfield\pyproject.toml:4:6]
 3 |     "pip>=26.1.2", # installed 26.1.2
 4 |     "sqlalchemy>=2.0.41", # installed 2.1.0b2
   :      ^^^^^^^^^^^^^^^^^^^^|^^^^^^^^^^^^^^^^^^^^
   :                          `-- vulnerable dependency declared here
 5 |     "pyyaml>=5.1", # installed 6.0.3
 6 | ]
   `----
  help: Update 'sqlalchemy' to >= 0.7.0

pyscan::vulnerability

  x PYSEC-2019-123: SQLAlchemy before 1.3.0b3 allows SQL Injection via the order_by parameter. The fix (commit 30307c4) was applied only to the main branch and was never...
   ,-[C:\git\greenfield\pyproject.toml:4:6]
 3 |     "pip>=26.1.2", # installed 26.1.2
 4 |     "sqlalchemy>=2.0.41", # installed 2.1.0b2
   :      ^^^^^^^^^^^^^^^^^^^^|^^^^^^^^^^^^^^^^^^^^
   :                          `-- vulnerable dependency declared here
 5 |     "pyyaml>=5.1", # installed 6.0.3
 6 | ]
   `----
  help: Update 'sqlalchemy' to >= 1.3.0b3

pyscan::vulnerability

  x PYSEC-2019-124: SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
   ,-[C:\git\greenfield\pyproject.toml:4:6]
 3 |     "pip>=26.1.2", # installed 26.1.2
 4 |     "sqlalchemy>=2.0.41", # installed 2.1.0b2
   :      ^^^^^^^^^^^^^^^^^^^^|^^^^^^^^^^^^^^^^^^^^
   :                          `-- vulnerable dependency declared here
 5 |     "pyyaml>=5.1", # installed 6.0.3
 6 | ]
   `----
  help: Update 'sqlalchemy' to >= 1.2.18

  ──────────────────────────────────────
  scanned 5  │  vulnerable 1  │  risk CRITICAL  │  0.55s
  ──────────────────────────────────────

Desktop (please complete the following information):

• OS: Windows 10
• Python 3.14.5

Additional context
pyproject.toml:

[project]
dependencies = [
    "pip>=26.1.2", # installed 26.1.2
    "sqlalchemy>=2.0.41", # installed 2.1.0b2
    "pyyaml>=5.1", # installed 6.0.3
]

[project.optional-dependencies]
dev = [
    "pip-audit>=2.10.0", # installed 2.10.1
    "pyscan-rs>=2.1.3", # installed 2.1.3
]

[54ny7]

AI says the pyscan could call the global pip. But sqlalchemy is not installed, only in the .venv.
Or probably the version parsing is failed.

If I add click to the toml, install it, then there is no "pip error: Package not found in pip". I collected the problematic packages first.

[54ny7]

Is the capital name the problem?! (AI says...)
Huhh... If I write SQLAlchemy in the toml file... there is no pip error...