[Arch] pip-audit scans unpinned requirements.txt, not the pinned requirements.lock #68

New issue

Closed

opened 2026-07-01 07:27:24 +02:00 by bullitt · 1 comment

bullitt commented

2026-07-01 07:27:24 +02:00

Owner

Severity: Medium | Category: Security

Dockerfile:12 runs pip-audit -r requirements.txt (unpinned), while requirements.lock (fully pinned ==) is what actually ships to production. A vulnerability only present in a transitive dependency's locked version could go undetected.

Recommendation: Run pip-audit -r requirements.lock in the Docker test stage (in addition to or instead of the unpinned file). Verify the lock file is current first.

Full detail: docs/architecture-review.md § C + § H.3

**Severity:** Medium | **Category:** Security `Dockerfile:12` runs `pip-audit -r requirements.txt` (unpinned), while `requirements.lock` (fully pinned `==`) is what actually ships to production. A vulnerability only present in a transitive dependency's locked version could go undetected. **Recommendation:** Run `pip-audit -r requirements.lock` in the Docker test stage (in addition to or instead of the unpinned file). Verify the lock file is current first. Full detail: `docs/architecture-review.md` § C + § H.3

bullitt added the

arch

label

2026-07-01 07:27:57 +02:00

bullitt referenced this issue from a commit

2026-07-01 07:55:49 +02:00

build: raise CI coverage gate to 50% and audit the pinned lock file (fixes #67, #68)

bullitt commented

2026-07-01 07:56:13 +02:00

Author

Owner

Fixed on branch architecture-rework, commit f7003d2: pip-audit now scans requirements.lock (filtered to drop the two non-PyPI spaCy model wheels, which pip-audit --strict can't resolve and were never covered by the old requirements.txt-based scan either). Verified clean locally against the filtered lock file.

Fixed on branch `architecture-rework`, commit f7003d2: `pip-audit` now scans `requirements.lock` (filtered to drop the two non-PyPI spaCy model wheels, which `pip-audit --strict` can't resolve and were never covered by the old `requirements.txt`-based scan either). Verified clean locally against the filtered lock file.

bullitt closed this issue

2026-07-01 07:56:41 +02:00

No labels

arch

harness

security

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

bullitt/trackbox#68

No description provided.

Rows
Columns