chore(deps-dev): update pip-audit requirement from >=2.0.0 to >=2.10.1

[dependabot]

Updates the requirements on pip-audit to permit the latest version.

Release notes

Sourced from pip-audit's releases.

v2.10.1

Fixed

• Fixed a KeyError crash when an OSV vulnerability record contains an affected entry that omits the optional ranges field (#1046)

Changelog

Sourced from pip-audit's changelog.

[2.10.1]

Fixed

• Fixed a KeyError crash when an OSV vulnerability record contains an affected entry that omits the optional ranges field (#1046)

[2.10.0]

Added

• pip-audit now supports the --osv-url URL flag, which can be used to retrieve vulnerabilities from a custom OSV service. This is useful for organizations that host their own mirror of the OSV database, or that have custom OSV records (#810)

• pip-audit now supports the Ecosyste.ms vulnerability service with --vulnerability-service=esms (#903).

Changed

• The minimum version of Python is now 3.10 (#905)

Fixed

• Fixed a bug where pip-audit would fail to parse pyproject.toml files containing TOML 1.0.0 features (#910)

• CycloneDX JSON/XML output now correctly links vulnerabilities to their affected components via the affects field (#980)

[2.9.0]

Added

• pip-audit now supports PEP 751 lockfiles. These lockfiles can be audited in "project" mode by passing --locked to pip-audit (#888)

[2.8.0]

Added

... (truncated)

Commits

• 8894eb8 Merge pull request #1056 from pypa/copilot/release-2101
• 1c625b7 Update version in README.md to 2.10.1
• fd2094b Prep 2.10.1 release
• 58d2488 build(deps): bump github/codeql-action from 4.35.2 to 4.36.1 (#1052)
• 8df9420 build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 (#1044)
• 3f618d3 build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (#1053)
• 4849132 Restrict OIDC token to publish job (#1050)
• c1eb69a Fix KeyError when OSV affected entry omits optional ranges field (#1046)
• 68de07f Merge pull request #1054 from pypa/fix/1047
• ef31c9e Formatting fixes
• Additional commits viewable in compare view

[iknowkungfubar]

Review: PR #30 — chore(deps-dev): update pip-audit requirement

Summary

Standard dev-dependency version bump: pip-audit>=2.0.0 → >=2.10.1. One file, one line changed. No issues.

Findings

No findings. This is a well-scoped Dependabot PR with no logic or security concerns.

What Went Well

• Clean, focused change
• Appropriate version constraint range (not pinned, allowing minor/patch updates)
• No security concerns introduced

Severity Counts

• 🔴 Blocking: 0
• 🟡 Critical: 0
• 🔵 Important: 0
• ⚪ Suggestion: 0

[iknowkungfubar]

Dependabot Review: pip-audit >=2.0.0 to >=2.10.1

Summary

Clean version bump for pip-audit in requirements-dev.txt. Safe change - the new version (2.10.1) is a significant jump from 2.0.0 but pip-audit is backward compatible within major version.

Severity Counts

• Blocking: 0 | Critical: 0 | Important: 0 | Suggestion: 0 | Question: 0

What Went Well

• No breaking API changes expected for CLI usage (--strict flag)
• Mergeable status: MERGEABLE - no conflicts

[iknowkungfubar]

Code Review: autoresearch-stack #30 — pip-audit bump

Summary

Dependabot PR: pip-audit >=2.0.0 to >=2.10.1.

Spot check: clean version bump, no API compatibility concerns (CLI-only tool).

Severity Counts

• 🔴 Blocking: 0
• 🟡 Critical: 0
• 🔵 Important: 0
• ⚪ Suggestion: 0
• ❓ Question: 0

[iknowkungfubar]

Routine dependabot version bump: pip-audit >=2.0.0 -> >=2.10.1. Necessary to stay current with vulnerability database. Looks good.

[iknowkungfubar]

Review: chore(deps-dev): update pip-audit requirement

Summary

Dependabot bump of pip-audit from >=2.0.0 to >=2.10.1. Significant version jump.

✅ pip-audit is a CI-only dependency — no runtime impact
✅ Wider version range allows for more flexible dependency resolution
⚠️ Verify pip-audit 2.10.x output format is compatible with CI parsing

[iknowkungfubar]

✅ Dependabot: pip-audit 2.0.0→2.10.1 - Major bump but pip-audit is well-maintained and backward-compatible. LGTM.

[iknowkungfubar]

Review: chore(deps-dev): update pip-audit requirement from >=2.0.0 to >=2.10.1

Severity Counts: 🔴 Blocking: 0, 🟡 Critical: 0, 🔵 Important: 0, ⚪ Suggestion: 1, ❓ Question: 0

Summary

Dependabot version bump. Clean diff — only the pip-audit version constraint changed in requirements-dev.txt (from >=2.0.0 to >=2.10.1).

Findings

⚪ SUGGESTION

Significant version jump from 2.0.0 to 2.10.1. pip-audit is a security auditing tool — verify the new version is compatible with the project's Python version and CI pipeline.

[iknowkungfubar]

Review: autoresearch-stack#30 — pip-audit version bump

Summary

Dependabot bump of pip-audit from >=2.0.0 to >=2.10.1 in requirements-dev.txt.

Assessment

• ✅ pip-audit 2.10.x includes vulnerability database format changes and fixes — good to be current
• ✅ Dev-only dependency, no runtime impact
• ✅ Single-line change

No findings. Approve.

[iknowkungfubar]

Review: autoresearch-stack PR#30

Summary: Dependabot bumps pip-audit from >=2.0.0 to >=2.10.1. 1 file, 1 line change.

Verdict: ✅ Safe version constraint expansion. Merging.