public_git/bambuddy
1
0
Fork 0
mirror of https://github.com/maziggy/bambuddy.git synced 2026-09-30 03:01:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

chore(ci): also ignore disputed PyJWT CVE-2025-45768 in ci.yml

Browse Source 
security.yml had this ignore added in 9d440beb but ci.yml runs its
  own pip-audit step with a separate ignore list. CI was still failing
  on main + dev. Reasoning identical to the security.yml comment —
  disputed by PyJWT maintainers, no fix exists, Bambuddy uses
  secrets.token_urlsafe(64) and rejects short secrets.
This commit is contained in:
maziggy
2026-05-20 13:21:59 +02:00
parent 4910a0fb86
commit 2b8887c4d5
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+9 -1
View File
@@ -73,7 +73,15 @@ jobs:
run: |
# CVE-2026-4539: low-severity ReDoS in Pygments AdlLexer (indirect dep via mkdocs-material/pytest/rich).
# No fix available yet. Remove --ignore-vuln once Pygments releases a patched version.
pip-audit --desc on --ignore-vuln CVE-2026-4539
#
# CVE-2025-45768 (PYSEC-2025-183 / GHSA-65pc-fj4g-8rjx): disputed by PyJWT maintainers.
# Advisory says "key length is chosen by the application that uses the library" — no
# PyJWT fix exists or will exist. Bambuddy is safe: backend/app/core/auth.py:184 uses
# secrets.token_urlsafe(64) (~86 chars of entropy) for auto-generated secrets and
# rejects file-loaded secrets shorter than 32 chars at :177. Keep ignored permanently.
pip-audit --desc on \
--ignore-vuln CVE-2026-4539 \
--ignore-vuln CVE-2025-45768
backend-tests:
name: Backend Tests