How to deal with vulnerabilities that won't be resolved anytime soon?

[sebastian-philipp]

Hi,

I'm dealing with pytest-dev/py#293 right now:

$ pip-audit -r constraints.txt
Found 1 known vulnerabilities in 1 package
Name         Version ID                  Fix Versions
------------ ------- ------------------- -------------------
py           1.11.0  PYSEC-2022-42969

But it turns out that this is a very low-impact issue and won't be resolved given the maintenance status of py. I know there is a --ignore-vuln, but I'd like to ask for a best practice to deal with this. Given that py is a package used in many many projects and affected by a low-priority vuln that will likely never be fixed.

See also: pytest-dev/py#287 (comment)

[sebastian-philipp]

seems to be solved by pytest 7.2.0