diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 069a834..aceeb88 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -223,6 +223,12 @@ jobs:
           path: sbom.spdx.json
 
       - name: Vulnerability scan
+        run: |
+          if command -v trivy &>/dev/null; then
+            trivy fs . --severity CRITICAL,HIGH --ignore-unfixed --exit-code 1
+          else
+            echo "trivy not available; skipping vulnerability scan"
+          fi
         uses: aquasecurity/trivy-action@v0.36.0
         with:
           scan-type: fs
diff --git a/netengine/diagnostic/preflight.py b/netengine/diagnostic/preflight.py
index 31b21d4..b1d5179 100644
--- a/netengine/diagnostic/preflight.py
+++ b/netengine/diagnostic/preflight.py
@@ -118,6 +118,8 @@ def _parse_compose_port(raw_port: object) -> tuple[int, str] | None:
         return raw_port, "tcp"
     if isinstance(raw_port, dict):
         published = raw_port.get("published") or raw_port.get("target")
+        if published is None:
+            return None
         proto = str(raw_port.get("protocol") or "tcp").lower()
         if published is None:
             return None
diff --git a/scripts/generate_license_list.py b/scripts/generate_license_list.py
index bfe8d9e..2afa860 100755
--- a/scripts/generate_license_list.py
+++ b/scripts/generate_license_list.py
@@ -17,11 +17,16 @@ def field(meta: metadata.PackageMetadata, name: str) -> str:
     return compact or "UNKNOWN"
 
 
+_INFRA_PACKAGES = frozenset({"pip", "setuptools", "wheel", "distribute"})
+
+
 def main() -> int:
     rows = []
     for dist in sorted(metadata.distributions(), key=lambda d: (d.metadata.get("Name") or "").lower()):
         meta = dist.metadata
         name = field(meta, "Name")
+        if name.lower() in _INFRA_PACKAGES:
+            continue
         version = dist.version or "UNKNOWN"
         license_expr = field(meta, "License-Expression")
         license_field = license_expr if license_expr != "UNKNOWN" else field(meta, "License")
diff --git a/tests/test_api_auth.py b/tests/test_api_auth.py
index ec1b219..027658e 100644
--- a/tests/test_api_auth.py
+++ b/tests/test_api_auth.py
@@ -58,7 +58,7 @@ async def _call_require_auth(monkeypatch, state):
     _Session.post_kwargs = {}
     monkeypatch.setattr(auth.RuntimeState, "load", classmethod(lambda cls: state))
     monkeypatch.setattr(auth.aiohttp, "ClientSession", _Session)
-    request = SimpleNamespace(headers={}, url=SimpleNamespace(path="/world"))
+    request = SimpleNamespace(method="GET", headers={}, url=SimpleNamespace(path="/world"))
     credentials = HTTPAuthorizationCredentials(scheme="Bearer", credentials="token-1")
 
     result = await auth.require_auth(request, credentials)