fix-python

name	fix-python
description	Apply a Python dependency CVE fix: bump requirements pin, regenerate requirements-build.txt with pybuild-deps, verify with pip-audit.
allowed-tools	["Bash(pybuild-deps *)","Bash(pip-audit *)","Bash(pip *)","Bash(pip3 *)","Bash(sed *)","Bash(grep *)","Bash(cat *)","Read","Write","Edit","Glob","Grep"]

Fix Python CVE

Inputs

Input	Required
PACKAGE	yes
FIXED_VERSION	yes
CVE_ID	yes
REPO_DIR	yes (cwd)
CVE_PYBUILD_SETUPTOOLS_WORKAROUND	optional, default false

Steps

1. Find requirements file

REQ_FILE=""
for f in requirements.txt requirements-dev.txt; do
  if grep -qi "^${PACKAGE}" "$f" 2>/dev/null; then
    REQ_FILE="$f"
    break
  fi