Patrick Buckley 13a2df3bc9 chore(ci): ignore disputed PYSEC-2025-183 in pip-audit ...

The pyjwt 2.12.1 advisory (\"weak encryption\") is disputed by the
supplier — the key length is the calling application's
responsibility, not the library's.  Turnstone generates its JWT
signing keys via the standard ``secrets`` module at
operator-controlled strength (see ``turnstone/core/auth.py``), so the
advisory does not apply to this codebase.

No fix version is available — pyjwt 2.12.1 is the current PyPI
latest as of 2026-05-21.  Adding ``--ignore-vuln PYSEC-2025-183``
with the rationale documented in-line so a future reviewer can
re-evaluate when an upstream fix or a non-disputed re-issue lands.

The advisory was published between main's last CI pass (2026-05-19)
and the interactive-cleanup PR's CI run (2026-05-21); main's
security job will fail next push without this fix.

2026-05-20 17:51:46 -07:00

..

workflows

chore(ci): ignore disputed PYSEC-2025-183 in pip-audit

2026-05-20 17:51:46 -07:00

renovate.json

feat: render rich media embeds for MCP tool results (#292)

2026-04-04 14:47:25 -07:00