Audit every optional dependency stack

[0xsl1m]

What changed

• Discover every declared project.optional-dependencies key directly from
  pyproject.toml.
• Run a separate strict pip-audit matrix cell for each extra, including dev
  and the combined all graph.
• Keep the existing base, container-lock, and build-lock audit unchanged.
• Record the completed production-readiness milestone and add an Unreleased
  changelog entry.

Why

The existing audit covered base dependencies and locked build/container graphs,
but it did not resolve each supported optional installation. Vulnerabilities or
resolver failures in ML, PII, dashboard, integration, or development stacks
could therefore bypass the supply-chain gate.

Impact

Every current and future optional extra is now independently resolved and
vulnerability-scanned on Python 3.12. --strict turns dependency-collection
failures into CI failures, and fail-fast: false preserves evidence for every
stack when one cell fails.

Validation

• actionlint against the repository-pinned image
• Exact Linux dashboard extra resolution and live audit: no known vulnerabilities
• Full local suite: 320 passed, 2 skipped
• git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shadowshield	Ready	Preview, Comment	Jul 26, 2026 12:25am