[lhoupert]

The pip-audit table in the PR comment (seen on EOPF-Explorer/data-model#322) listed certifi PYSEC-2026-4320 twice, because pip-audit itself returns it once per fix version, and showed each description as the first 120 characters of the raw advisory, so GHSA ### Summary headings appeared inline and text was cut mid-word. Advisories that share an ID or alias are now merged into one row (and one annotation) listing every fix version, the footer still gives pip-audit's raw count when duplicates were merged, and the description is the advisory's first sentence with markdown headings dropped, cut at a word if it is over 120 characters.

How this was made

Claude Code wrote the change and its tests after @lhoupert flagged the duplicate rows and unreadable descriptions in the data-model#322 comment and asked to keep the total count. The four new tests fail on main and pass with the change; pytest (183 tests), mypy and pre-commit pass, and feeding pip-audit's real output for the data-model#322 pins through the report gives 24 rows instead of 25 with one-sentence descriptions. A ponytail over-engineering pass trimmed two spots before commit. An independent Claude Code review agent then found that a heading followed by a single newline still hid the summary (about 1 in 10 real PyPI advisories) and that alias-chain merges depended on hash order; both are fixed in b35d3fe with tests that fail without the fix, and replaying 298 real PyPI advisory descriptions changes 25 rows, all to the advisory's summary sentence. The reviewer's abbreviation ("e.g.") and fix-version ordering points were left as is: no real advisory hit the first, and a sentence split on capital letters made Django advisories worse. CI, including the integration tests, passes.

— Claude Code, on behalf of @lhoupert

[github-actions]

✅ All test workflows behaved as expected

13 passed, 0 failed

Test	Name	Expected	Actual	Bandit	pip-audit	Result
01	requirements · flat · clean	success	success	—	—	✅
02	requirements · src/ · bandit HIGH	failure	failure	B105, B404, B602	—	✅
03	requirements · src/+scripts/ · bandit HIGH + pip-audit	failure	failure	B105, B404, B602	cryptography, idna, requests, urllib3	✅
04	uv · flat · clean	success	success	—	—	✅
05	uv · src/ · pip-audit vuln	failure	failure	—	certifi, idna, requests, urllib3	✅
06	uv · src/+scripts/ · bandit MEDIUM	failure	failure	B324, B506	—	✅
07	poetry · flat · clean	success	success	—	—	✅
08	poetry · src/ · bandit MEDIUM + pip-audit	failure	failure	B105, B324	certifi, cryptography, idna, requests, urllib3	✅
09	pipenv · flat · clean	success	success	—	—	✅
10	pipenv · src/+scripts/ · bandit HIGH	failure	failure	B404, B602	—	✅
11	requirements · flat · clean (root working dir)	success	success	—	—	✅
12	uv · flat · bandit-only (no pip-audit)	failure	failure	B404, B602	disabled	✅
14	uv · flat · low threshold (B101 assert)	failure	failure	B101	disabled	✅