fix(deps): replace safety with pip-audit to resolve CVE-2025-14009

safety pulls in nltk 3.9.2 which has a critical Zip Slip vulnerability
(CVE-2025-14009) with no patched version available. pip-audit provides
the same dependency vulnerability scanning without the nltk dependency,
using the OSV database (PyPA-maintained).

Signed-off-by: Sebastian Mendel <info@sebastianmendel.de>

Author: CybotTM

.github/workflows/ci.yml

@@ -96,18 +96,18 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install bandit safety
+          pip install bandit pip-audit
 
       - name: Run bandit
         run: |
           bandit -r cli_audit -f json -o bandit-report.json || true
           bandit -r cli_audit
         continue-on-error: true
 
-      - name: Run safety check
+      - name: Run pip-audit
         run: |
-          safety check --json || true
-          safety check
+          pip-audit --desc --fix --dry-run || true
+          pip-audit
         continue-on-error: true
 
   build:

pyproject.toml

@@ -42,7 +42,7 @@ dev = [
     "isort>=7.0.0",
     "build>=1.3.0",
     "twine>=6.2.0",
-    "safety>=3.7.0",
+    "pip-audit>=2.10.0",
     "markdown>=3.10",
 ]