fix: update pip-audit ignore list to include PYSEC-2026-196 for accurate vulnerability checks

Author: totonga

.github/workflows/ci.yml

@@ -72,9 +72,10 @@ jobs:
 
       - name: Audit for known vulnerabilities
         run: |
-          # CVE-2026-3219 affects pip itself (no fix released yet); ignore it so
-          # that vulnerabilities in actual project dependencies still fail CI.
-          uv run pip-audit --strict --ignore-vuln CVE-2026-3219
+          # CVE-2026-3219 / PYSEC-2026-196 affects pip itself (no fix released
+          # yet); ignore both aliases so that vulnerabilities in actual project
+          # dependencies still fail CI.
+          uv run pip-audit --strict --ignore-vuln CVE-2026-3219 --ignore-vuln PYSEC-2026-196
 
   release:
     name: Release

pyproject.toml

@@ -55,8 +55,8 @@ dev = [
 
 [tool.uv]
 # Minimum versions that resolve known CVEs in transitive dependencies.
-# CVE-2026-3219 affects pip itself (no fix released yet); ignore it so
-# pip-audit is run with --ignore-vuln CVE-2026-3219.
+# CVE-2026-3219 / PYSEC-2026-196 affects pip itself (no fix released yet); ignore both
+# aliases so pip-audit is run with --ignore-vuln CVE-2026-3219 --ignore-vuln PYSEC-2026-196.
 constraint-dependencies = [
     "cryptography>=48.0.1", # GHSA-537c-gmf6-5ccf
     "gitpython>=3.1.50",    # CVE-2026-44244, GHSA-mv93-w799-cj2w