Mohd KaifandClaude Sonnet 5 d4127131ba fix(ci): match pip-audit ignore list against vuln aliases, not just id (#1543) ...

#1540 added GHSA-4j2p-28q2-5m79 to security-scan.yml's IGNORED_VULN_IDS to
suppress the open, unpatched accelerate<=1.14.0 path traversal advisory
(Semantica doesn't call load_checkpoint_in_model/load_checkpoint_and_dispatch).
That commit's own CI run still failed: pip-audit's OSV-backed report picked
CVE-2026-69112 as the vuln's canonical `id` and demoted the GHSA id to an
alias, but the shell/JS matching only ever compared against `.id`.

List both identifiers and match against `.id` plus `.aliases` (which
pip-audit includes by default for JSON output) in the audit gate, the
"Vulnerability details" printer, and the PR-comment script, so an ignored
advisory is excluded regardless of which alias the report surfaces as
canonical. Verified against the actual failing report from run 34296586683 -
the corrected filter now yields 0 actionable vulnerabilities.

Also add osv-scanner.toml (per GHSA-4j2p-28q2-5m79's Scorecard code-scanning
remediation) so the weekly Scorecard "Vulnerabilities" check stops flagging
the same accepted, unpatched advisory.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-09 12:46:02 +05:30

..

benchmark.yml

fix(ci): drop unpinnable benchmarks/requirements.txt install (#1345)

2026-08-31 18:57:28 +05:30

ci.yml

fix(deps): address review feedback on slim core dependencies (#1513)

2026-09-07 20:32:00 +05:00

codeql.yml

fix(security): resolve Scorecard vulnerability and token-permission alerts (#1280)

2026-08-30 20:58:39 +05:30

container-scan.yml

fix(docker): revert runtime base image to python:3.13-slim (#1509)

2026-09-07 15:29:41 +05:30

defender-for-devops.yml

fix(ci): stop checkov's suppressed checks from reopening as new alerts (#1346)

2026-08-31 19:29:24 +05:30

docs.yml

fix(ci): update actions/deploy-pages pin to current v5 (v5.0.1) (#1387)

2026-09-02 13:59:42 +05:00

install-matrix.yml

ci: reusable install action, install-matrix, and release hardening (#1266)

2026-08-30 17:30:21 +05:00

release.yml

fix(ci): run pypi-publish before Sigstore signing writes to dist/

2026-09-05 19:25:51 +05:30

scorecard.yml

ci: reusable install action, install-matrix, and release hardening (#1266)

2026-08-30 17:30:21 +05:00

security-scan.yml

fix(ci): match pip-audit ignore list against vuln aliases, not just id (#1543)

2026-09-09 12:46:02 +05:30

verify-action-pins.yml

security: SHA-pin all Actions, harden release pipeline, add pin verification (#824)

2026-08-03 19:17:10 +05:30