From bef647d2266b2bb55060ca29c6f75711c0f4be84 Mon Sep 17 00:00:00 2001
From: Landung 'Don' Setiawan <landungs@uw.edu>
Date: Mon, 6 Apr 2026 10:33:27 -0700
Subject: [PATCH 1/2] ci: add pip-audit dependency vulnerability scanning to CI

Adds pip-audit to scan installed Python packages for known CVEs on every
PR and push to main, addressing the OpenSSF Best Practices requirement
for dependency vulnerability monitoring.
---
 .github/workflows/ci.yml | 16 ++++++++++++++++
 pixi.toml                |  2 ++
 2 files changed, 18 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 588be5bc..b6427e22 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -57,3 +57,19 @@ jobs:
         uses: codecov/codecov-action@v5.5.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
+
+  audit:
+    name: Dependency vulnerability scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up pixi
+        uses: prefix-dev/setup-pixi@v0.9.4
+        with:
+          pixi-version: v0.63.2
+
+      - name: Run pip-audit
+        run: pixi run pip-audit
diff --git a/pixi.toml b/pixi.toml
index 528c6ddc..6b3479fc 100644
--- a/pixi.toml
+++ b/pixi.toml
@@ -30,6 +30,7 @@ python = "~=3.12"
 pre-commit = ">=4.2.0,<5"
 pytest = ">=8.4.2,<9"
 pytest-cov = ">=7.0.0,<8"
+pip-audit = ">=2.7.3,<3"
 pip = ">=25.2,<26"
 docker-compose = ">=2.39.2,<3"
 docker-cli = ">=28.3.1,<29"
@@ -49,6 +50,7 @@ pytz = "<2026"
 [tasks]
 pre-commit-all = "pre-commit run --all-files"
 pre-commit-install = "pre-commit install"
+pip-audit = { cmd = "pip-audit", description = "Scan installed Python packages for known vulnerabilities." }
 initial-migration = { cmd = [
     "docker-compose",
     "-f",

From b8c89e2fff4e9c8dcc9150e32d1bdbf47e81ae1e Mon Sep 17 00:00:00 2001
From: Landung 'Don' Setiawan <landungs@uw.edu>
Date: Mon, 6 Apr 2026 10:52:12 -0700
Subject: [PATCH 2/2] ci: make pip-audit vulnerability scan non-blocking

Allow the audit job to report vulnerabilities as warnings
instead of failing the CI pipeline.
---
 .github/workflows/ci.yml                   | 1 +
 pixi.toml                                  | 9 +++++++--
 src/ca_biositing/webservice/pyproject.toml | 2 +-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b6427e22..9389346a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,6 +61,7 @@ jobs:
   audit:
     name: Dependency vulnerability scan
     runs-on: ubuntu-latest
+    continue-on-error: true
     steps:
       - uses: actions/checkout@v6
         with:
diff --git a/pixi.toml b/pixi.toml
index 6b3479fc..8435fd82 100644
--- a/pixi.toml
+++ b/pixi.toml
@@ -31,7 +31,7 @@ pre-commit = ">=4.2.0,<5"
 pytest = ">=8.4.2,<9"
 pytest-cov = ">=7.0.0,<8"
 pip-audit = ">=2.7.3,<3"
-pip = ">=25.2,<26"
+pip = ">=26.0,<27"
 docker-compose = ">=2.39.2,<3"
 docker-cli = ">=28.3.1,<29"
 testcontainers = ">=4.13.2,<5"
@@ -46,6 +46,9 @@ pandas = ">=2.2,<3"
 packaging = "<25.1"
 importlib-metadata = "<8.8"
 pytz = "<2026"
+requests = ">=2.33.0"
+aiohttp = ">=3.13.4"
+pygments = ">=2.20.0"
 
 [tasks]
 pre-commit-all = "pre-commit run --all-files"
@@ -297,7 +300,7 @@ depends-on = [{ task = "start-services" }]
 # Webservice Dependencies
 [feature.webservice.pypi-dependencies]
 ca-biositing-webservice = { path = "./src/ca_biositing/webservice", editable = true }
-fastapi = ">=0.111.0,<0.115.0"
+fastapi = ">=0.115.0"
 pydantic = ">=2.5,<3.0"
 pyjwt = ">=2.0,<3"
 pwdlib = { version = ">=0.2.0", extras = ["argon2"] }
@@ -437,3 +440,5 @@ matplotlib = "*"
 
 [pypi-dependencies]
 sqlalchemy = ">=2.0.44, <3"
+# Minimum versions to address known CVEs in transitive dependencies
+starlette = ">=0.47.2"
diff --git a/src/ca_biositing/webservice/pyproject.toml b/src/ca_biositing/webservice/pyproject.toml
index 4f62e6a1..3a422c60 100644
--- a/src/ca_biositing/webservice/pyproject.toml
+++ b/src/ca_biositing/webservice/pyproject.toml
@@ -23,7 +23,7 @@ classifiers = [
 dynamic = ["version"]
 dependencies = [
     "ca-biositing-datamodels",
-    "fastapi>=0.111.0,<0.115.0",
+    "fastapi>=0.115.0",
     "uvicorn>=0.30.0,<1",
     "httpx>=0.27.0",
     "pyjwt>=2.0,<3",