Security: uv audit workflow

[daidahao]

Checklist before merging this PR:

• Mentioned all issues that this PR fixes or addresses.
• Summarized the updates of this PR under Summary.
• Added an entry under Unreleased in the Changelog.

Fixes #.

Summary

uv audit (available since 0.10.8) provides auditing against lockfile for known vulnerabilities. This PR proposes a weekly workflow to run uv audit and surface any vulnerabilities.

• The PR itself does not block merge or release actions, but automatically generates audit report in the format of weekly CI log.
• Since uv audit requires 0.10.8 or higher, I have updated uv version to 0.11.7 (released on 2026-04-15).
• Also update astral-sh/setup-uv to 8.1.0 (released on 2026-04-16) which now enforces immutable release.

Ref:

• uv audit documentation

Other Information

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.24%. Comparing base (21924b1) to head (f53824d).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3102      +/-   ##
==========================================
- Coverage   96.31%   96.24%   -0.07%     
==========================================
  Files         161      161              
  Lines       17350    17350              
==========================================
- Hits        16710    16699      -11     
- Misses        640      651      +11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dennisbader]

Thanks @daidahao. I'm not 100% convinced we need this though. What would be the benefit of having, and also compared to the "7 days" wait rule we just introduced in #3096?

[daidahao]

@dennisbader

My understanding is that "7 days wait rule" would prevent installing malicious packages, but does not prevent "vulnerable packages" which uv audit does. For instance, if I ran uv audit now, I get the following results:

Found 3 known vulnerabilities and no adverse project statuses in 281 packages

Vulnerabilities:

nbconvert 6.5.4 has 3 known vulnerabilities:

- GHSA-4c99-qj7h-p3vg: nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames

  Fixed in: 7.17.1

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-39377

- GHSA-7jqv-fw35-gmx9: nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding

  Fixed in: 7.17.1

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2026-39378

- GHSA-xm59-rqc7-hhvf: nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows

  Fixed in: 7.17.0

  Advisory information: https://nvd.nist.gov/vuln/detail/CVE-2025-53000

which tells us that nbconvert 6.5.4 is vulnerable (not malicious). Depending on the severity, we may decide to update the nbconvert to, say, 7.1.7.1 to prevent "Arbitrary File Read".

We do have dependabot that scans for vulnerable dependencies regularly, but sometimes (like example above) it misses those vulnerabilities.

I think uv audit and dependabot could complement each other for more comprehensive scans. And just like dependabot, the uv audit workflow only produces suggestions and does not block any merge or release actions.

[dennisbader]

Alright, makes sense in that case. I'm currently checking the nbcovert vulnerability. Seems like it might come from our release dependency m2r2 (markdown to rst) which is anyway not well maintained. I'm working on a replacement. Probably we'll go for myst-parser or similar

[dennisbader]

LGTM, thanks 🚀

[dennisbader]

@daidahao, the nbconvert vulnerabilities are fixed in #3104. Thanks for spotting it 🚀