Lucas Gomide 5f4ac9f407 chore: resolve pip-audit failures for click, pillow, and json-repair (#6542) ...

The vulnerability scan started failing when PYSEC-2026-2132 (click) and
PYSEC-2026-2253..2257 (pillow) were published on Jul 12. Both have fixed
releases within our constraints, so `uv.lock` upgrades click to 8.4.2 and
pillow to 12.3.0. A newer json-repair advisory (GHSA-xf7x-x43h-rpqh) also
surfaced; its fix is outside the `json-repair~=0.25.2` pin and 0.25.x lacks
the vulnerable `schema_repair` module, so it joins the ignore list in
`vulnerability-scan.yml` with a justification.

2026-07-14 08:34:56 -04:00

..

build-uv-cache.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

codeql.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

docs-broken-links.yml

Restrict docs broken-links workflow permissions (#6330)

2026-06-25 10:52:33 +08:00

generate-tool-specs.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

linter.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

nightly.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

pr-size.yml

ci: pin third-party actions to commit SHAs

2026-05-20 19:01:53 +08:00

pr-title.yml

ci: pin third-party actions to commit SHAs

2026-05-20 19:01:53 +08:00

publish.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

stale.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

tests.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

type-checker.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

update-test-durations.yml

ci: pin third-party actions to commit SHAs (#5869)

2026-05-21 18:08:34 -05:00

vulnerability-scan.yml

chore: resolve pip-audit failures for click, pillow, and json-repair (#6542)

2026-07-14 08:34:56 -04:00