From 96fbff9ee22e2db88ac2ab775cd5e40d7be4b02e Mon Sep 17 00:00:00 2001
From: SnapOtter <snapotter.hq@gmail.com>
Date: Mon, 27 Apr 2026 01:34:41 +0800
Subject: [PATCH] fix: add GHSA-55v6-g8pm-pw4c to pip-audit ignore list

rembg 2.0.62 has both CVE-2026-40086 and GHSA-55v6-g8pm-pw4c
(same vulnerability, different ID sources). Both need ignoring
since upgrading rembg to 2.0.75 breaks the dependency tree.
---
 .github/workflows/ci.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1929ea54..59b18ed1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,6 +94,7 @@ jobs:
           --ignore-vuln CVE-2026-40086
           --ignore-vuln CVE-2026-25990
           --ignore-vuln CVE-2026-40192
+          --ignore-vuln GHSA-55v6-g8pm-pw4c
 
   build:
     name: Build