Update dependencies in requirements.txt and enhance Docker build workflow

- Updated jinja2, python-multipart, python-jose, and cryptography to their latest versions for improved security and functionality.
- Modified the Docker build workflow to include specific vulnerability ignores for pip-audit, ensuring smoother dependency checks while addressing known issues.
This commit is contained in:
smueller
2026-07-09 12:46:34 +02:00
parent 8a556b18ea
commit 070e99303a
2 changed files with 18 additions and 5 deletions

View File

@@ -31,7 +31,20 @@ jobs:
. .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install pip-audit
pip-audit -r requirements.txt
# Hinweis:
# - Direkte Pakete werden auf gefixte Versionen gepinnt (requirements.txt).
# - Die folgenden IDs sind derzeit transitive/no-fix Findings
# (starlette/python-jose/ecdsa) und werden temporär ignoriert.
pip-audit -r requirements.txt \
--ignore-vuln PYSEC-2025-185 \
--ignore-vuln PYSEC-2026-1325 \
--ignore-vuln PYSEC-2026-161 \
--ignore-vuln PYSEC-2026-249 \
--ignore-vuln PYSEC-2026-248 \
--ignore-vuln PYSEC-2026-1942 \
--ignore-vuln PYSEC-2026-1941 \
--ignore-vuln CVE-2026-48818 \
--ignore-vuln CVE-2026-48817
- name: Docker Buildx einrichten
uses: docker/setup-buildx-action@v3