[AUTO-INF-8] Add pip-audit or safety to dependency vulnerability scanning #10344

New issue

Open

opened 2026-04-18 08:57:10 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-18 08:57:10 +00:00

Owner

Metadata

Commit message: chore(security): add pip-audit to dependency vulnerability scanning
Branch name: chore/add-pip-audit-scanning

Background and Context

The cleveragents-core project has code security scanning tools configured (bandit, semgrep) and runs them in the CI pipeline. However, there is no dependency vulnerability scanning tool configured to detect known CVEs in third-party packages.

The project already acknowledges CVE awareness (see comment in pyproject.toml about CVE-2026-34515 mitigation for aiohttp), but there is no automated scanning to catch such vulnerabilities.

Current Behavior

The CI security job runs:

nox -s security_scan (bandit and semgrep for code security)
nox -s dead_code (vulture for dead code detection)

But there is no dependency vulnerability scanning.

Expected Behavior

The CI pipeline should include a dependency vulnerability scanner (pip-audit or safety) to detect known CVEs in dependencies before they reach production.

Acceptance Criteria

pip-audit or safety is added to dev dependencies in pyproject.toml
A new nox session dependency_audit is created to run the scanner
The security CI job includes the dependency audit step
CI fails if any known vulnerabilities are found
Documentation is updated to explain the dependency scanning process

Duplicate Check

Searched open and closed issues for: "security", "vulnerability", "CVE", "pip-audit", "safety", "dependency scan", "uv lock"

No existing issues found for adding pip-audit or safety to the CI pipeline.

Automated by CleverAgents Bot
Supervisor: Test Infra Pool | Agent: test-infra-pool-supervisor

## Metadata - **Commit message**: `chore(security): add pip-audit to dependency vulnerability scanning` - **Branch name**: `chore/add-pip-audit-scanning` ## Background and Context The cleveragents-core project has code security scanning tools configured (bandit, semgrep) and runs them in the CI pipeline. However, there is no dependency vulnerability scanning tool configured to detect known CVEs in third-party packages. The project already acknowledges CVE awareness (see comment in pyproject.toml about CVE-2026-34515 mitigation for aiohttp), but there is no automated scanning to catch such vulnerabilities. ## Current Behavior The CI security job runs: - `nox -s security_scan` (bandit and semgrep for code security) - `nox -s dead_code` (vulture for dead code detection) But there is no dependency vulnerability scanning. ## Expected Behavior The CI pipeline should include a dependency vulnerability scanner (pip-audit or safety) to detect known CVEs in dependencies before they reach production. ## Acceptance Criteria - [ ] pip-audit or safety is added to dev dependencies in pyproject.toml - [ ] A new nox session `dependency_audit` is created to run the scanner - [ ] The security CI job includes the dependency audit step - [ ] CI fails if any known vulnerabilities are found - [ ] Documentation is updated to explain the dependency scanning process ## Duplicate Check Searched open and closed issues for: "security", "vulnerability", "CVE", "pip-audit", "safety", "dependency scan", "uv lock" No existing issues found for adding pip-audit or safety to the CI pipeline. --- **Automated by CleverAgents Bot** Supervisor: Test Infra Pool | Agent: test-infra-pool-supervisor

HAL9000 referenced this issue

2026-04-18 09:20:39 +00:00

[AUTO-INF-POOL] Status: Test Infrastructure Analysis (Cycle 1) #10348

HAL9000 referenced this issue

2026-04-18 10:00:24 +00:00

[AUTO-INF-POOL] Cycle 3 Status — Test Infrastructure Analysis Complete #10469