From dfdc1c67e6ee72a5103e4b99cceb105f2e7be58b Mon Sep 17 00:00:00 2001 From: maziggy Date: Fri, 17 Jul 2026 08:59:06 +0200 Subject: [PATCH] ci: upgrade setuptools in pip-audit jobs to clear PYSEC-2026-3447 The GitHub runner's Python toolcache ships setuptools 79.0.1, which pip-audit flags for PYSEC-2026-3447 (fixed in 83.0.0), failing the blocking Backend Security job. A fix version exists, so upgrade setuptools in the install step rather than --ignore-vuln. Applied to both ci.yml (blocking) and security.yml (scheduled scan). --- .github/workflows/ci.yml | 5 ++++- .github/workflows/security.yml | 5 ++++- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a474ee856..da2e8439a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -65,7 +65,10 @@ jobs: - name: Install dependencies run: | - python -m pip install --upgrade pip + # Upgrade setuptools too: the runner's Python toolcache ships an old + # setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0). + # A fix exists, so we upgrade rather than --ignore-vuln. + python -m pip install --upgrade pip setuptools pip install -r requirements.txt pip install pip-audit diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 41b07f726..9d7236a80 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -125,7 +125,10 @@ jobs: - name: Install dependencies run: | - python -m pip install --upgrade pip + # Upgrade setuptools too: the runner's Python toolcache ships an old + # setuptools that trips pip-audit (PYSEC-2026-3447, fixed in 83.0.0). + # A fix exists, so we upgrade rather than --ignore-vuln. + python -m pip install --upgrade pip setuptools pip install -r requirements.txt pip install pip-audit