I am just migrating to the newest version of the vulnerability checker safety for my Python project. Before, my CI workflow failed with the safety check command because of the vulnerability associated to cryptography==43.0.3 (vulnerability ID 76170). Now I've set up the pyupio/safety-action GitHub action. It still shows the above mentioned vulnerability in the output of the action. However, it does not fail the workflow. Hence, it is very hard to detect the vulnerability as I will not check the output of the action every time. The documentation says: This will run Safety scan and It'll fail your CI pipeline if any vulnerable packages are found. Am I doing something wrong? Do I have to set a flag so it fails? Do I misunderstand something? Or is this vulnerability just not severe enough? Continue reading...
