---
type: faq
name: dependency-lower-bounds-trigger-scorecard-vulnerability-alerts
tags: [testing]
source: .claude/CLAUDE.md
---

# FAQ: What should I know about dependency lower bounds trigger Scorecard vulnerability alerts?

## Answer

Even if installed versions are safe, OpenSSF Scorecard flags `pyproject.toml` specs that *allow* vulnerable versions (e.g., `pydantic>=2.0.0` permits 2.0–2.3 which have CVEs).

**How to fix:**
- bump lower bounds past the patched version, not just the lockfile

```
pyproject.toml
```

## Related Topics
- **Error**: Detailed error: Dependency lower bounds trigger Scorecard vulnerability alerts
