diff --git a/.github/utils/requirements_audit.txt b/.github/utils/requirements_audit.txt index d41510d8..1761760b 100644 --- a/.github/utils/requirements_audit.txt +++ b/.github/utils/requirements_audit.txt @@ -1 +1 @@ -pip-tools==7.5.2 +pip-tools==7.5.3 diff --git a/.github/workflows/ci_tests.yml b/.github/workflows/ci_tests.yml index d5c71c8c..56820435 100644 --- a/.github/workflows/ci_tests.yml +++ b/.github/workflows/ci_tests.yml @@ -74,6 +74,12 @@ jobs: uses: pypa/gh-action-pip-audit@v1.1.0 with: inputs: '${{ runner.temp }}/requirements.txt' + # CVE-2025-69872: DiskCache 5.6.3 + # DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. + # An attacker with write access to the cache directory can achieve arbitrary code execution + # when a victim application reads from the cache. + ignore-vulns: | + CVE-2025-69872 pytest: name: pytest (${{ matrix.os[1] }}-py${{ matrix.python-version }})