fix(ci): audit this project's dependencies, not the scanners'

[livingstaccato]

The defect

.github/workflows/security.yml audited an environment that contained no project dependencies at all:

- run: |
    uv venv                                   # empty environment
    uv pip install bandit safety pip-audit    # the only things in it
- run: |
    source .venv/bin/activate
    pip-audit || true                         # audits bandit, safety, pip-audit

Nothing installs this project into that virtualenv. The only packages pip-audit could see were the three scanners and their transitive dependencies, so the step reported on them and nothing else. || true then discarded the exit status, so neither the misdirection nor a genuine finding could turn the build red.

wrknv hit the visible half of the same arrangement: safety pulls in nltk, nltk drew an unpatched advisory (PYSEC-2026-3740), and the build went red over a package that appears nowhere in its lock. This repo was spared only because it swallowed the result.

The fix

scripts/audit_dependencies.sh:

• exports the resolved lock (uv export --no-emit-workspace), dev groups included, so a vulnerable test-time dependency still counts;
• runs pip-audit from uvx, which puts the scanner's own dependencies in a separate environment;
• lets the exit status through. That is only safe once the subject is correct, which is why the two changes belong together.

safety is dropped. It was installed but never invoked, and its check subcommand has been deprecated since June 2024.

Bandit is unaffected — it reads source, not installed packages — and keeps its own environment.

Verification

Run against the current lock:

==> auditing 173 locked packages
No known vulnerabilities found

Noted, not fixed

pyproject.toml has a [tool.bandit] section that the workflow never reaches: it installs plain bandit rather than bandit[toml] and passes no -c pyproject.toml, so that configuration is silently ignored. Separate defect, left alone here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Dhi1SLuFiEseRhH9iLMv8Q