File size: 1,919 Bytes
e4ab0d4 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 | # Dependency security
This project treats the locked test dependency set as the dependency-review
surface. Local bootstrap, pull-request CI, and the weekly scheduled audit all
check `constraints-test.txt` with `pip-audit`.
## What gets audited
- `constraints-test.txt` pins the `[test]` extras from `pyproject.toml` plus
their transitive dependencies.
- The bootstrap scripts install the test extras against that lock, then run
`pip-audit` on the installed environment.
- CI audits the committed lock with `pip-audit -r constraints-test.txt` on each
pull request and on a weekly schedule, so newly disclosed CVEs in old pins are
caught even when nobody has touched the dependency files.
- Bandit remains a separate first-party-code scan. A green Bandit job does not
mean the dependency lock is clean.
## Regenerating the lock
Regenerate the lock only as an intentional dependency-change PR:
```powershell
scripts\bootstrap_test_env.ps1 -Force -Relock
```
```bash
bash scripts/bootstrap_test_env.sh --force --relock
```
Review and commit the resulting `constraints-test.txt` diff. Do not hand-edit
individual pins unless you are immediately re-running the relock command to
prove the full resolved set.
## Responding to a CVE
1. Open or update a dependency-security issue with the vulnerable package,
affected version, fixed version, and audit output.
2. Relock with the commands above.
3. Confirm `pip-audit` reports no known vulnerabilities.
4. Run the focused bootstrap/CI contract tests:
```powershell
.\.venv\Scripts\python -m pytest tests\scripts\test_bootstrap_constraints.py -q
```
5. If the relock changes more than the vulnerable package and normal
transitive bumps, call that out in the PR description so reviewers know what
to inspect.
Use `-NoAudit` / `--no-audit` only for explicit offline troubleshooting. Do not
merge a dependency lock that has not passed the audit gate.
|