From 8600b46d6c4d700bffd3541c09d53c1767a7d6ff Mon Sep 17 00:00:00 2001 From: maziggy Date: Fri, 17 Jul 2026 08:59:06 +0200 Subject: [PATCH] ci: upgrade setuptools in pip-audit jobs to clear PYSEC-2026-3447 The GitHub runner's Python toolcache ships setuptools 79.0.1, which pip-audit flags for PYSEC-2026-3447 (fixed in 83.0.0), failing the blocking Backend Security job. A fix version exists, so upgrade setuptools in the install step rather than --ignore-vuln. Applied to both ci.yml (blocking) and security.yml (scheduled scan). --- .github/workflows/ci.yml | 5 ++++- .github/workflows/security.yml | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b63ee55cb..e00b9c8d9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -68,7 +68,10 @@ jobs: - name: Install dependencies run: | - python -m pip install --upgrade pip + # Upgrade setuptools too: the runner's Python toolcache ships an old + # setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0). + # A fix exists, so we upgrade rather than --ignore-vuln. + python -m pip install --upgrade pip setuptools pip install -r requirements.txt pip install pip-audit diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 41b07f726..9d7236a80 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -125,7 +125,10 @@ jobs: - name: Install dependencies run: | - python -m pip install --upgrade pip + # Upgrade setuptools too: the runner's Python toolcache ships an old + # setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0). + # A fix exists, so we upgrade rather than --ignore-vuln. + python -m pip install --upgrade pip setuptools pip install -r requirements.txt pip install pip-audit