pip-audit checks installed packages against the OSV vulnerability database. The compiler processes untrusted input (arbitrary .vera source files), making dependency CVEs a real concern.

Add a CI job:

dependency-audit:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - uses: actions/setup-python@v5
      with: { python-version: "3.12" }
    - run: pip install -e . && pip install pip-audit
    - run: pip-audit --strict

This catches CVEs in lark, z3-solver, wasmtime, or their transitive dependencies. Low effort, high value.