Merge pull request 'Block releases with vulnerable runtime dependencies' (#989) from timmy/988-block-vulnerable-runtime-dependencies into main

.gitea/workflows/ci.yml

@@ -15,6 +15,8 @@ jobs:
       - uses: actions/setup-python@v5
         with: { python-version: "3.11" }
       - run: pip install -r requirements.txt
+      - run: pip install -r requirements-audit.txt
+      - run: python3 -m pip_audit -r requirements.txt --strict
       - run: python3 -m pytest tests/ -q
 
   build-release:

requirements-audit.txt

@@ -0,0 +1 @@
+pip-audit==2.10.1

requirements.txt

@@ -2,7 +2,7 @@ fastapi==0.133.1
 httpx==0.28.1
 pydantic==2.13.4
 Pillow==12.3.0
-python-multipart==0.0.22
+python-multipart==0.0.32
 pytest==9.1.1
 pywebpush==2.1.2
 rjsmin==1.2.5

tests/test_ci_workflow.py

@@ -17,6 +17,23 @@ def test_ci_installs_declared_requirements_before_tests():
     assert install < tests
 
 
+def test_ci_audits_pinned_runtime_dependencies_before_tests_and_release_build():
+    text = WORKFLOW.read_text()
+    lint = text[text.index("  lint:") : text.index("  build-release:")]
+    build = text[text.index("  build-release:") : text.index("  browser-journey:")]
+
+    audit_install = lint.index("pip install -r requirements-audit.txt")
+    audit = lint.index("python3 -m pip_audit -r requirements.txt --strict")
+    tests = lint.index("python3 -m pytest tests/ -q")
+    assert audit_install < audit < tests
+    assert "needs: lint" in build
+
+
+def test_runtime_multipart_parser_uses_advisory_fixed_release():
+    requirements = Path("requirements.txt").read_text().splitlines()
+    assert "python-multipart==0.0.32" in requirements
+
+
 def test_release_promotion_waits_for_tests_and_bundle():
     text = WORKFLOW.read_text()
     release = text[text.index("  release-candidate:") :]