ComfyUI/custom_nodes/koolook/docs/maintainers/dependency-security.md

Dependency security

This project treats the locked test dependency set as the dependency-review surface. Local bootstrap, pull-request CI, and the weekly scheduled audit all check constraints-test.txt with pip-audit.

What gets audited

• constraints-test.txt pins the [test] extras from pyproject.toml plus their transitive dependencies.
• The bootstrap scripts install the test extras against that lock, then run pip-audit on the installed environment.
• CI audits the committed lock with pip-audit -r constraints-test.txt on each pull request and on a weekly schedule, so newly disclosed CVEs in old pins are caught even when nobody has touched the dependency files.
• Bandit remains a separate first-party-code scan. A green Bandit job does not mean the dependency lock is clean.

Regenerating the lock

Regenerate the lock only as an intentional dependency-change PR:

scripts\bootstrap_test_env.ps1 -Force -Relock

bash scripts/bootstrap_test_env.sh --force --relock

Review and commit the resulting constraints-test.txt diff. Do not hand-edit individual pins unless you are immediately re-running the relock command to prove the full resolved set.

Responding to a CVE

1. Open or update a dependency-security issue with the vulnerable package, affected version, fixed version, and audit output.
2. Relock with the commands above.
3. Confirm pip-audit reports no known vulnerabilities.
4. Run the focused bootstrap/CI contract tests:

.\.venv\Scripts\python -m pytest tests\scripts\test_bootstrap_constraints.py -q

5. If the relock changes more than the vulnerable package and normal transitive bumps, call that out in the PR description so reviewers know what to inspect.

Use -NoAudit / --no-audit only for explicit offline troubleshooting. Do not merge a dependency lock that has not passed the audit gate.