Fixing invalid vulnerability report (#402)

* Fixing invalid vulnerability report

* Removing some pinned items

* more

* pip upgrade

Author: chayim

.github/workflows/ci.yml

@@ -26,18 +26,22 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - name: install python
-        uses: actions/setup-python@v3.1.2
+        uses: actions/setup-python@v4
         with:
           python-version: ${{env.pythonversion}}
       - name: create local poetry install
         run: |
             python -m venv .venv
             source .venv/bin/activate
+            pip install --upgrade pip setuptools
             python -m pip install poetry
             poetry install
       - uses: trailofbits/[email protected]
         with:
           virtual-environment: .venv
+          ignore-vulns: |
+            GHSA-w596-4wvx-j9j6 # subversion related git dep, dependency for pytest. This is no impact here.
+            GHSA-2p9h-ccw7-33gf # invalid ddos comment on the cleo package
 
   lint:
     name: Linter
@@ -47,7 +51,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
       - name: Setup Python 3.9
-        uses: actions/setup-python@v4.3.0
+        uses: actions/setup-python@v4
         with:
           python-version: ${{env.pythonversion}}
         #----------------------------------------------
@@ -64,7 +68,7 @@ jobs:
         #----------------------------------------------
       - name: Load cached venv
         id: cached-poetry-dependencies
-        uses: actions/cache@v3.0.11
+        uses: actions/cache@v3
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}
@@ -119,7 +123,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
       - name: Setup Python ${{ matrix.pyver }}
-        uses: actions/setup-python@v4.3.0
+        uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.pyver }}
         #----------------------------------------------
@@ -136,7 +140,7 @@ jobs:
         #----------------------------------------------
       - name: Load cached venv
         id: cached-poetry-dependencies
-        uses: actions/cache@v3.0.11
+        uses: actions/cache@v3
         with:
           path: .venv
           key: venv-${{ runner.os }}-${{ hashFiles('**/poetry.lock') }}

poetry.lock

@@ -42,7 +42,6 @@ click = "^8.0.1"
 pptree = "^3.1"
 types-redis = ">=3.5.9,<5.0.0"
 python-ulid = "^1.0.3"
-cleo = "1.0.0a5"
 typing-extensions = "^4.4.0"
 hiredis = "^2.0.0"
 more-itertools = "^8.14.0"