Security audit: refresh scan baselines for current dependency set

[danielhanchen]

Why

The Security audit workflow is red on main and on every PR: the pip scan-packages :: extras shard exits 1 with 5 non-baselined CRITICAL findings (last completed run on main: 29982017685, only that shard failed). Root cause is baseline drift, not a real detection:

• openai 2.47.0 rewrote the code inside five previously baselined findings (the websocket event loops gained reconnect handling, the workload identity module changed), so their evidence_hash keys no longer match the committed allowlist and the findings reopened by design.
• The just-merged dictation stack pulled new deps (av, argbind, openai, randomname, omegaconf, ...) into the extras shard; all of their findings are MEDIUM and do not gate, but they account for most of the 186 lines of scanner noise in the log.
• While reproducing, the hf-stack shard turned out to be one dependency release away from the same failure: unsloth-zoo 2026.7.5 changed two baselined test files (1 CRITICAL, 1 HIGH reopened). Those are refreshed here too.

What

Adds 7 provenance-verified entries to scripts/scan_packages_baseline.json (195 -> 202). No existing entry is removed or modified, so the currently green shards cannot regress. No blind --write-baseline regeneration: each entry was generated by scanning the exact resolved archive (openai 2.47.0 wheel, unsloth_zoo 2026.7.5 sdist) and the flagged file was opened and read at the flagged lines first.

Verification of reopened findings

Package	Version	File	Check	Verdict	Justification
openai	2.47.0	openai/_base_client.py	C2 polling loop	benign	while True is SyncPage.iter_pages, the pagination iterator
openai	2.47.0	openai/auth/_workload.py	IMDS + network	benign	Azure IMDS / GCP metadata token providers for the documented workload identity federation feature
openai	2.47.0	openai/resources/beta/responses/responses.py	C2 polling loop	benign	websocket __aiter__ yield/recv loop; hash drifted because 2.47.0 added _reconnect handling
openai	2.47.0	openai/resources/realtime/realtime.py	C2 polling loop	benign	same websocket __aiter__ pattern
openai	2.47.0	openai/resources/responses/responses.py	C2 polling loop	benign	same websocket __aiter__ pattern
unsloth-zoo	2026.7.5	tests/test_vision_collator_audio.py	writes /tmp + executes	benign	test asserts an inline /tmp/a.wav path is passed through extract_audio_info
unsloth-zoo	2026.7.5	tests/test_gemma4_forced_float32_ple_dtype.py	obfuscation + exec	benign	tests compile()/exec() the project's own generated Gemma4 PLE cast helper source

The remaining 181 extras findings are MEDIUM (non-gating). They were reviewed by package and are all textbook false positives on top-1000 PyPI code: build machinery and plugin __import__ (setuptools, numba, sklearn/scipy array_api_compat), bytecode marshal caches (jinja2, setuptools), env config reads (click, huggingface-hub, triton knobs, omegaconf, argbind), chr() unicode fixtures in tests (networkx, regex), base64-embedded fonts/payloads with legitimate consumers (pillow ImageFont, pydantic Base64 types), and "bc1" wallet-prefix collisions with the BC1 DDS pixel format (pillow), spline boundary conditions (scipy), and theano broadcastables (sympy). Nothing suspicious was found: no typosquats, no obfuscated payloads, no unexpected network exfiltration.

Local shard results (same requirement sets and Python 3.12 as CI)

• pip scan-packages :: extras: exit 0, 99 suppressed (was exit 1 with 5 active CRITICAL)
• pip scan-packages :: hf-stack: exit 0, 122 suppressed (was exit 1 with 1 CRITICAL + 1 HIGH after the unsloth-zoo 2026.7.5 release)
• pip scan-packages :: studio: exit 0, 151 suppressed

Local extras resolution matched the failing CI run exactly (124 archives, identical versions), and the five added openai evidence blocks are byte-identical to the CI log's active findings.