---
type: error
name: dependency-lower-bounds-trigger-scorecard-vulnerability-alerts
confidence: Verified
tags: [testing]
source: .claude/CLAUDE.md
---

# Error: Dependency lower bounds trigger Scorecard vulnerability alerts

## Signature

Dependency lower bounds trigger Scorecard vulnerability alerts

## Root Cause

Even if installed versions are safe, OpenSSF Scorecard flags `pyproject.toml` specs that *allow* vulnerable versions (e.g., `pydantic>=2.0.0` permits 2.0–2.3 which have CVEs).

## Resolution

1. bump lower bounds past the patched version, not just the lockfile

## Confidence

**Verified** — Confirmed by prior incident (Lessons Learned)

## Related Topics
- Task: Update test mocks and assertions
