Skip to content

fix(security): require patched setuptools and enforce audits - #33

Open
jp-cruz wants to merge 2 commits into
mainfrom
fix/setuptools-83-audit
Open

fix(security): require patched setuptools and enforce audits#33
jp-cruz wants to merge 2 commits into
mainfrom
fix/setuptools-83-audit

Conversation

@jp-cruz

@jp-cruz jp-cruz commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Summary

  • require setuptools 83.0.0, which fixes GHSA-h35f-9h28-mq5c
  • audit Guardian's resolved project dependencies in strict mode
  • preserve and upload the JSON report while making findings fail CI
  • ignore generated egg-info metadata

Validation

  • pip-audit project scan: no known vulnerabilities
  • pytest: 57 passed, 9 live tests skipped
  • coverage: 58.37% (threshold 50%)
  • Black and workflow YAML validation passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant