burnash/gspread

broken pipeline due to `pip-audit`

Open

#1,561 opened on Jul 5, 2025

View on GitHub
 (0 comments) (0 reactions) (0 assignees)Python (6,606 stars) (960 forks)batch import
good first issue

Description

output:

Found 2 known vulnerabilities, ignored 1 in 1 package
Name    Version ID                  Fix Versions
------- ------- ------------------- ------------
urllib3 2.2.3   GHSA-48p4-8xcf-vxj5 2.5.0
urllib3 2.2.3   GHSA-pq67-6m6q-mj2v 2.5.0

we can ignore these in tox.ini to "fix" the pipeline — they do not seem relevant to the project

Contributor guide

Tech stack
python
Domain
ci cd
Issue type
bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
None
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
95
Research direction
Look at the `tox.ini` file in the repository root. Add a `pip audit` ignore directive for the two vulnerabilities (GHSA 48p4-8xcf vxj5 and GHSA pq67-6m6q mj2v) mentioned in the issue. The project uses `pip audit` in its CI pipeline; the exact configuration line to add should follow the `pip audit` documentation for ignoring vulnerabilities. No other changes are needed.