scripts: pip: minimal security upgrades

gitpython 3.1.50->3.1.59, pillow 12.2.0->12.3.0, pyasn1 0.6.3->0.6.4, sh 2.2.2->2.3.0; pip-audit whitelist CVEs.

Signed-off-by: Thomas Stilwell <thomas.stilwell@nordicsemi.no>

Author: thst-nordic

.github/workflows/validate-pip-requirements-fixed-file.yml

@@ -8,6 +8,7 @@ on:
       - 'v*-branch'
     paths:
       - 'scripts/requirements*.txt'
+      - 'scripts/requirements-fixed.in'
       - '.github/workflows/validate-pip-requirements-fixed-file.yml'
 
 permissions:
@@ -70,12 +71,9 @@ jobs:
             pip3 install \
               --index-url https://files.nordicsemi.com/artifactory/api/pypi/nordic-pypi/simple \
               pip-compile-cross-platform==1.4.2+nordic.3 --upgrade
+            # Expand requirements-fixed.in to CLI args (paths are west-topdir-relative).
             pip-compile-cross-platform \
-              bootloader/mcuboot/scripts/requirements.txt \
-              zephyr/scripts/requirements.txt \
-              nrf/scripts/requirements-ci.txt \
-              nrf/scripts/requirements-extra.txt \
-              nrf/scripts/requirements.txt \
+              $(grep -Ev '^\s*(#|$)' nrf/scripts/requirements-fixed.in | xargs) \
               --output-file nrf/scripts/requirements-fixed.txt \
               --min-python-version 3.12 \
               --index-url https://files.nordicsemi.com/artifactory/api/pypi/nordic-pypi/simple

scripts/pip-audit-whitelist.yml

@@ -6,3 +6,11 @@ py:
   - CVE-2026-3219
   - PYSEC-2024-311
   - PYSEC-2026-151
+  - PYSEC-2026-1325
+  - PYSEC-2026-3447
+  - PYSEC-2026-3544
+  - PYSEC-2026-3552
+  - PYSEC-2026-3553
+  - PYSEC-2026-3554
+  - PYSEC-2026-3721
+  - GHSA-537c-gmf6-5ccf

scripts/requirements-ci.txt

@@ -11,7 +11,7 @@ python-stdnum
 pytz
 pyusb
 qrcode
-stringcase==1.2.0
+stringcase>=1.2.0
 toml
 wget
 python-dotenv

scripts/requirements-extra.txt

@@ -12,3 +12,4 @@ idna>=3.7 # https://github.com/advisories/GHSA-jjg7-2v4v-x38h
 libusb>=1.0.26
 matter_idl
 python-path>=0.1.3
+sh>=2.2.4 # https://github.com/advisories/GHSA-q38v-wp89-2w55

scripts/requirements-fixed.in

@@ -0,0 +1,12 @@
+# Compile input for nrf/scripts/requirements-fixed.txt
+#
+# Paths are west-topdir-relative. Used by ncs-tool-pip-compile (read-requirements-fixed-in.sh).
+# Later entries win on conflicting constraints; keep nrf/scripts/requirements-extra.txt last.
+#
+#   https://github.com/nrfconnect/ncs-tool-pip-compile
+
+bootloader/mcuboot/scripts/requirements.txt
+zephyr/scripts/requirements.txt
+nrf/scripts/requirements-ci.txt
+nrf/scripts/requirements.txt
+nrf/scripts/requirements-extra.txt

scripts/requirements-fixed.txt

@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile-cross-platform
 # To update, run:
 #
-#    pip-compile-cross-platform bootloader/mcuboot/scripts/requirements.txt zephyr/scripts/requirements.txt nrf/scripts/requirements-ci.txt nrf/scripts/requirements-extra.txt nrf/scripts/requirements.txt --output-file nrf/scripts/requirements-fixed.txt --min-python-version 3.12 --index_url https://files.nordicsemi.com/artifactory/api/pypi/nordic-pypi/simple
+#    pip-compile-cross-platform bootloader/mcuboot/scripts/requirements.txt zephyr/scripts/requirements.txt nrf/scripts/requirements-ci.txt nrf/scripts/requirements.txt nrf/scripts/requirements-extra.txt --output-file nrf/scripts/requirements-fixed.txt --min-python-version 3.12 --index_url https://files.nordicsemi.com/artifactory/api/pypi/nordic-pypi/simple
 #
 --index-url https://files.nordicsemi.com/artifactory/api/pypi/nordic-pypi/simple
 
@@ -53,7 +53,7 @@ future==1.0.0 ; python_version >= "3.12" and python_version < "4.0"
 gcovr==8.6 ; python_version >= "3.12" and python_version < "4.0"
 gitdb==4.0.12 ; python_version >= "3.12" and python_version < "4.0"
 gitlint-core==0.19.1 ; python_version >= "3.12" and python_version < "4.0"
-gitpython==3.1.50 ; python_version >= "3.12" and python_version < "4.0"
+gitpython==3.1.59 ; python_version >= "3.12" and python_version < "4.0"
 graphviz==0.21 ; python_version >= "3.12" and python_version < "4.0"
 grpcio-tools==1.76.0 ; python_version >= "3.12" and python_version < "4.0"
 grpcio==1.76.0 ; python_version >= "3.12" and python_version < "4.0"
@@ -101,7 +101,7 @@ oscrypto==1.3.0 ; python_version >= "3.12" and python_version < "4.0"
 packaging==25.0 ; python_version >= "3.12" and python_version < "4.0"
 pathspec==1.0.3 ; python_version >= "3.12" and python_version < "4.0"
 patool==4.0.3 ; python_version >= "3.12" and python_version < "4.0"
-pillow==12.2.0 ; python_version >= "3.12" and python_version < "4.0"
+pillow==12.3.0 ; python_version >= "3.12" and python_version < "4.0"
 pkg-about==2.0.9 ; python_version >= "3.12" and python_version < "4.0"
 platformdirs==4.5.1 ; python_version >= "3.12" and python_version < "4.0"
 plotly==6.5.1 ; python_version >= "3.12" and python_version < "4.0"
@@ -113,7 +113,7 @@ protobuf==6.33.4 ; python_version >= "3.12" and python_version < "4.0"
 psutil==7.2.1 ; python_version >= "3.12" and python_version < "4.0"
 py-utlx==2.0.2 ; python_version >= "3.12" and python_version < "4.0"
 py==1.11.0 ; python_version >= "3.12" and python_version < "4.0"
-pyasn1==0.6.3 ; python_version >= "3.12" and python_version < "4.0"
+pyasn1==0.6.4 ; python_version >= "3.12" and python_version < "4.0"
 pycparser==2.23 ; python_version >= "3.12" and python_version < "4.0" and implementation_name != "PyPy"
 pycryptodome==3.21.0 ; python_version >= "3.12" and python_version < "4.0"
 pyelftools==0.32 ; python_version >= "3.12" and python_version < "4.0"
@@ -159,7 +159,7 @@ semantic-version==2.10.0 ; python_version >= "3.12" and python_version < "4.0"
 semver==3.0.4 ; python_version >= "3.12" and python_version < "4.0"
 setuptools-scm==9.2.2 ; python_version >= "3.12" and python_version < "4.0"
 setuptools==80.10.1 ; python_version >= "3.12" and python_version < "4.0"
-sh==2.2.2 ; python_version >= "3.12" and python_version < "4.0" and sys_platform != "win32"
+sh==2.3.0 ; python_version >= "3.12" and python_version < "4.0"
 six==1.17.0 ; python_version >= "3.12" and python_version < "4.0"
 sly==0.5 ; python_version >= "3.12" and python_version < "4.0"
 smmap==5.0.2 ; python_version >= "3.12" and python_version < "4.0"