Add dependency vulnerability scanning

[paul-gerber-svg]

Context & Motivation

To improve project security, we should automatically scan our Python dependencies for known CVEs during CI. Integrating pip-audit prevents using dependencies with known vulnerabilites.

Proposed Change

Integrate pip-audit into the repository. We can include this by using one of the two following approaches:

• Integrate the official standalone GitHub Action into our CI workflow (pypa/pip-audit)

• Add pip-auditas a dev dependency and call it manually

[s-heppner]

I agree, though before it makes sense to add this, we need clear rules on how to respond to the output of this tool. What happens if a dependency contains known vulnerabilities? How do we react? How do we prove that we are affected or unaffected (for example if we don't use any of the affected code of the dependency)? What are our timeframes?

On a more cynical note, afaik CVEs are considered too slow nowadays. In between pushing a vulnerability fix to GitHub and publishing a CVE to that vulnerability, it has already been exploited by AI agents that analyzed the diff of the patch.