Skip to content

Adding ignore for pip 25.2 pip-audit vulnerability, removing stale ones #50

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 1, 2025
Merged

Adding ignore for pip 25.2 pip-audit vulnerability, removing stale ones #50

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 2 additions & 8 deletions .github/workflows/code_checks.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,12 +55,6 @@ jobs:
uses: pypa/gh-action-pip-audit@1220774d901786e6f652ae159f7b6bc8fea6d266
with:
virtual-environment: .venv/
# GHSA-887c-mr87-cxwp torch vulnerability without a fix yet
# PYSEC-2025-41, PYSEC-2024-259: These ignores are temporary. Synthcity needs python below or at 2.4 and
# these vulnerabilities exist until 2.5. However, we'll be removing the Synthcity dependency in follow up.
# So we'll be able to upgrade torch and drop these there.
# GHSA-4xh5-x5gv-qwph: This is a vulnerability in pip 25.2 that has no fix version yet
ignore-vulns: |
GHSA-887c-mr87-cxwp
GHSA-3749-ghw9-m3mg
PYSEC-2025-41
PYSEC-2024-259
GHSA-4xh5-x5gv-qwph