# CVEs that pip-audit reports but which we have explicitly accepted as
# risk-managed. Each entry must include a justification and a tracking link.
# Remove an entry once the upstream cause is resolved and a fresh
# `uv lock --upgrade` no longer reports it.
#
# Format: one vulnerability ID per line, using a pip-audit-supported prefix
# such as CVE-, GHSA-, or PYSEC-. Lines starting with `#` and blank lines are
# ignored. Inline `#` comments after the ID are allowed and encouraged.
#
# To re-verify this list, run `uv run pip-audit` with no ignore flags and
# compare the reported IDs against the entries below. Anything listed here
# that pip-audit no longer reports is stale and should be deleted.
#
# The list is currently empty: the click and starlette entries were removed
# when the zenml dependency (whose pins blocked the fixed versions) was
# dropped and a bare `uv run pip-audit` came back clean.
