fix: gracefully handle invalid specifiers in vulnerability DB (#873)

[raywcm]

Description

When the vulnerability database contains an invalid version specifier (e.g., =2.7.0 instead of ==2.7.0), safety crashes with an unhandled InvalidSpecifier exception and no useful error message.

Reproduction

Run safety check against an environment that includes tensorflow. The vulnerability DB entry for tensorflow contains the specifier =2.7.0 (single equals), which packaging.specifiers.SpecifierSet rejects.

Expected vs Actual

• Expected: Safety skips the invalid entry with a warning and continues scanning
• Actual: Unhandled exception: Invalid specifier: '=2.7.0' with no traceback or useful info

Fix

Wrap the SpecifierSet() call in a try-except to catch InvalidSpecifier, log a warning, and skip the offending entry.

Testing

• Invalid specifiers are now logged as warnings instead of crashing
• Normal specifiers continue to work as before

Fixes #873

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6a78597b-7afd-4f70-b20e-9562dae0818b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}