safishamsi 36b5e5cb29 chore(deps): drop unused safety dev dep (removes unfixable nltk HIGH) ...

`safety` was declared in the dev group but never invoked — the CI
security-scan job only runs bandit and pip-audit, and pip-audit already
provides the same dependency-CVE scanning. Its only practical effect was
pulling in nltk, which carries an unpatched HIGH path-traversal advisory
(GHSA-p4gq-832x-fm9v) with no fix available.

Removing safety drops nltk (and safety-schemas/typer/tenacity/tomlkit)
from the lockfile entirely, closing the alert with no loss of coverage.
Updated the stale CI comment that referenced safety. Full suite green
(2537 passed); pip-audit and bandit unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-29 11:29:45 +01:00

..

ci.yml

chore(deps): drop unused safety dev dep (removes unfixable nltk HIGH)

2026-06-29 11:29:45 +01:00

release-graph.yml

fix(ci): add cluster-only step to generate GRAPH_REPORT.md in release-graph

2026-06-10 22:01:12 +01:00