Description
No dependabot.yml, no safety check for Python dependencies, and no scanning of C++ dependencies for known CVEs. The numpy dependency is unpinned.
Recommended Fix
Add dependabot.yml for GitHub Actions and pip. Add pip-audit or safety to CI.
Description
No
dependabot.yml, nosafetycheck for Python dependencies, and no scanning of C++ dependencies for known CVEs. The numpy dependency is unpinned.Recommended Fix
Add
dependabot.ymlfor GitHub Actions and pip. Addpip-auditorsafetyto CI.