fix(security): patch cryptography in structured lock; accept unfixable transformers advisories

.github/workflows/ci.yml

@@ -56,6 +56,9 @@ jobs:
         with:
           fail-on-severity: low
           allow-licenses: MIT, Apache-2.0, BSD-3-Clause, 0BSD, 0BSD AND Apache-2.0 AND BSD-3-Clause AND MIT
+          # transformers advisories that cannot be remediated by a bump
+          # (spacy-huggingface-pipelines caps transformers <5); see .trivyignore.
+          allow-ghsas: GHSA-29pf-2h5f-8g72, GHSA-69w3-r845-3855
           comment-summary-in-pr: on-failure
 
   test:

.trivyignore

@@ -0,0 +1,17 @@
+# Trivy vulnerability ignore list.
+#
+# These entries suppress advisories that cannot currently be remediated by a
+# version bump because a required dependency caps the vulnerable package below
+# the first patched release. They are tracked for a proper fix (removing/replacing
+# the capping dependency) in a follow-up PR and should be revisited then.
+#
+# transformers < 5.x (analyzer, optional `transformers` extra):
+#   The `spacy-huggingface-pipelines` package (all releases 0.0.1-0.0.4) pins
+#   `transformers <5.0.0`, while the fixes below require transformers
+#   >=5.0.0rc3 / >=5.3.0. No version satisfies both, so these are accepted until
+#   spacy-huggingface-pipelines is dropped or replaced.
+#   (Also allow-listed for the dependency-review job via allow-ghsas in ci.yml.)
+CVE-2026-4372   # transformers RCE — fixed in 5.3.0
+GHSA-29pf-2h5f-8g72
+CVE-2026-1839   # transformers arbitrary code execution via malicious checkpoint — fixed in 5.0.0rc3
+GHSA-69w3-r845-3855

presidio-structured/pyproject.toml

@@ -43,3 +43,9 @@ dev = [
 [tool.coverage.run]
 relative_files = true
 source = ["."]
+
+[tool.uv]
+# cryptography is pulled in transitively (via presidio-anonymizer). Constrain it
+# to the patched line to avoid GHSA-537c-gmf6-5ccf (vulnerable OpenSSL bundled in
+# older cryptography wheels) without adding it as a direct dependency.
+constraint-dependencies = ["cryptography>=48.0.1"]